Microsoft-Windows-Health

85 events across 4 channels

Event	Title	Channel
8449	ProviderHost	Diagnostic
8449	Event ID 8449	Operational
8450	ProviderHost8450	Diagnostic
8450	Event ID 8450	Operational
8451	ProviderHost8451	Diagnostic
8451	Event ID 8451	Operational
8452	ProviderHost8452	Diagnostic
8452	Event ID 8452	Operational
8453	ProviderHost8453	DiagnosticVerbose
8453	Event ID 8453	Operational
8454	[Provider Provider] Data.	Diagnostic
8454	Event ID 8454	Operational
8455	[Provider Provider] Data.	Diagnostic
8455	Event ID 8455	Operational
8456	[Provider Provider] Data.	Diagnostic
8456	Event ID 8456	Operational
8457	[Provider Provider] Data.	Diagnostic
8457	Event ID 8457	Operational
8458	[Provider Provider] Data.	DiagnosticVerbose
8458	Event ID 8458	Operational
8459	HealthService	Diagnostic
8459	Event ID 8459	Operational
8460	HealthService8460	Diagnostic
8460	Event ID 8460	Operational
8461	HealthService8461	Diagnostic
8461	Event ID 8461	Operational
8462	HealthService8462	Diagnostic
8462	Event ID 8462	Operational
8463	HealthService8463	DiagnosticVerbose
8463	Event ID 8463	Operational
8464	ActivityId: ActivityId.	Operational
8465	ChangeType: ChangeType.	Operational
8466	HealthServiceClient	Diagnostic
8466	Event ID 8466	Operational
8467	HealthServiceClient8467	Diagnostic
8467	Event ID 8467	Operational
8468	HealthServiceClient8468	Diagnostic
8468	Event ID 8468	Operational
8469	HealthServiceClient8469	Diagnostic
8469	Event ID 8469	Operational
8470	HealthServiceClient8470	DiagnosticVerbose
8470	Event ID 8470	Operational
8471	HealthServiceHealthAgent	HealthAgent
8471	Event ID 8471	Operational
8472	HealthServiceHealthAgent8472	HealthAgent
8472	Event ID 8472	Operational
8473	HealthServiceHealthAgent8473	HealthAgent
8473	Event ID 8473	Operational
8474	HealthServiceHealthAgent8474	HealthAgent
8474	Event ID 8474	Operational
8475	HealthServiceHealthAgent8475	HealthAgent
8475	Event ID 8475	Operational
8476	Event ID 8476	DiagnosticVerbose
8476	Event ID 8476	Operational
8477	Event ID 8477	DiagnosticVerbose
8477	Event ID 8477	Operational
8478	Event ID 8478	DiagnosticVerbose
8478	Event ID 8478	Operational
8479	Event ID 8479	DiagnosticVerbose
8479	Event ID 8479	Operational
8480	[Provider Provider] Data.	DiagnosticVerbose
8480	Event ID 8480	Operational
8481	[Provider Provider] Data.	DiagnosticVerbose
8481	Event ID 8481	Operational
8482	[Provider Provider] Data.	DiagnosticVerbose
8482	Event ID 8482	Operational
8483	[Provider Provider] Data.	DiagnosticVerbose
8483	Event ID 8483	Operational
8484	Event ID 8484	DiagnosticVerbose
8484	Event ID 8484	Operational
8485	Event ID 8485	DiagnosticVerbose
8485	Event ID 8485	Operational
8486	Event ID 8486	DiagnosticVerbose
8486	Event ID 8486	Operational
8487	Event ID 8487	DiagnosticVerbose
8487	Event ID 8487	Operational
8488	Event ID 8488	DiagnosticVerbose
8488	Event ID 8488	Operational
8489	Event ID 8489	DiagnosticVerbose
8489	Event ID 8489	Operational
8490	Event ID 8490	DiagnosticVerbose
8490	Event ID 8490	Operational
8491	Event ID 8491	DiagnosticVerbose
8491	Event ID 8491	Operational
8496	{"ClusterInstanceId":"ClusterInstanceId","ClusterName":"ClusterName","ArmId":"Ar …	Operational

Event ID 8449: ProviderHost

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8449:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8450: ProviderHost8450

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8450:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8451: ProviderHost8451

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8451:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8452: ProviderHost8452

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8452:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8453: ProviderHost8453

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8453:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8454: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8454:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8455: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8455:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8456: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8456:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8457: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8457:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8458: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8458:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8459: HealthService

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8459:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8460: HealthService8460

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8460:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8461: HealthService8461

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8461:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8462: HealthService8462

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8462:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8463: HealthService8463

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8463:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8464: ActivityId: ActivityId.

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

ActivityId: ActivityId.

Message #

ActivityId: %1
Activity: %2
Target: %3
Reason: %4
Provider: %5

Fields #

Name	Description
`ActivityId` UnicodeString
`Activity` UnicodeString
`Target` UnicodeString
`Reason` UnicodeString
`Provider` UnicodeString

Event ID 8465: ChangeType: ChangeType.

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Description

ChangeType: ChangeType.

Message #

ChangeType: %1
Severity: %2
Source: %3
Resource Name: %4
Resource Type: %5
Title: %6
Description: %7
Remediation: %8
Fault Type Id: %9
Fault: %10

Fields #

Name	Description
`ChangeType` UnicodeString
`FaultSeverity` UnicodeString
`Source` UnicodeString
`ResourceName` UnicodeString
`ResourceType` UnicodeString
`Title` UnicodeString
`Description` UnicodeString
`Remediation` UnicodeString
`FaultTypeId` UnicodeString
`FaultId` UnicodeString

Event ID 8466: HealthServiceClient

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8466:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8467: HealthServiceClient8467

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8467:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8468: HealthServiceClient8468

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8468:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8469: HealthServiceClient8469

Provider: Microsoft-Windows-Health
Channel: Diagnostic
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8469:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8470: HealthServiceClient8470

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8470:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8471: HealthServiceHealthAgent

Provider: Microsoft-Windows-Health
Channel: HealthAgent
Task: HealthServiceHealthAgent

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8471:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceHealthAgent

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8472: HealthServiceHealthAgent8472

Provider: Microsoft-Windows-Health
Channel: HealthAgent
Task: HealthServiceHealthAgent

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8472:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceHealthAgent

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8473: HealthServiceHealthAgent8473

Provider: Microsoft-Windows-Health
Channel: HealthAgent
Task: HealthServiceHealthAgent

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8473:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceHealthAgent

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8474: HealthServiceHealthAgent8474

Provider: Microsoft-Windows-Health
Channel: HealthAgent
Task: HealthServiceHealthAgent

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8474:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceHealthAgent

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8475: HealthServiceHealthAgent8475

Provider: Microsoft-Windows-Health
Channel: HealthAgent
Task: HealthServiceHealthAgent

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8475:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceHealthAgent

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8476:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8476:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8477:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8477:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8478:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8478:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8479:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: ProviderHost

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8479:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: ProviderHost

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8480: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8480:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8481: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8481:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8482: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8482:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8483: [Provider Provider] Data.

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: Provider

Description

[Provider Provider] Data.

Message #

[Provider %1] %2

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8483:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: Provider

Description

[Provider ].

Fields #

Name	Description
`Provider` UnicodeString
`Data` UnicodeString

Event ID 8484:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8484:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8485:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8485:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8486:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8486:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8487:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthService

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8487:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8488:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8488:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8489:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8489:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8490:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8490:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8491:

Provider: Microsoft-Windows-Health
Channel: DiagnosticVerbose
Task: HealthServiceClient

Message #

%1

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8491:

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthServiceClient

Fields #

Name	Description
`Parameter1` UnicodeString

Event ID 8496: {"ClusterInstanceId":"ClusterInstanceId","ClusterName":"ClusterName","ArmId":"ArmId","CorrelationId":"CorrelationId","PublishTime":"PublishTime","IsLastMessage":"IsLastMessage","Fault":Fault}.

Provider: Microsoft-Windows-Health
Channel: Operational
Task: HealthService

Description

{"ClusterInstanceId":"ClusterInstanceId","ClusterName":"ClusterName","ArmId":"ArmId","CorrelationId":"CorrelationId","PublishTime":"PublishTime","IsLastMessage":"IsLastMessage","Fault":Fault}.

Message #

{"ClusterInstanceId":"%1","ClusterName":"%2","ArmId":"%3","CorrelationId":"%4","PublishTime":"%5","IsLastMessage":"%6","Fault":%7}

Fields #

Name	Description
`ClusterInstanceId` UnicodeString
`ClusterName` UnicodeString
`ArmId` UnicodeString
`CorrelationId` UnicodeString
`PublishTime` UnicodeString
`IsLastMessage` Boolean
`Fault` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f0a43898-4017-4d3b-acac-ff7fb8ac63cd

Defined in healthres.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0 · captured 2026-06-02

Downloads

Microsoft-Windows-Health registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)