Microsoft-Windows-HomeGroup-ControlPanel

76 events across 2 channels

Event	Title	Channel
5001	Core initialization failed.	Operational
5002	Page initialization failed.	Operational
5003	GetHomeGroupStatus failed.	Operational
5004	GetSharingFlags failed.	Operational
5005	PopulateSharedFolderList failed.	Operational
5006	Retrieve network discovery failed.	Operational
5007	Retrieve file sharing failed.	Operational
5008	Retrieve public folder failed.	Operational
5009	Retrieve printer sharing failed.	Operational
5010	Retrieve media sharing failed.	Operational
5011	Commit network discovery failed.	Operational
5012	Commit file sharing failed.	Operational
5013	Commit public folder failed.	Operational
5014	Commit printer sharing failed.	Operational
5015	Commit media sharing failed.	Operational
5016	Share folder failed.	Operational
5017	Retrieve printer sharing failed.	Operational
5018	Commit password protection failed.	Operational
5020	Commit public folder failed.	Operational
5021	Retrieving UI status from SSO failed.	Operational
5022	Failed to initialize homegroup printer monitor.	Operational
5023	Successfully installed homegroup printer	Operational
5024	Successfully removed homegroup printer	Operational
5025	Failed to install homegroup printer.	Operational
5026	Starting printer monitor	Operational
5027	Stopping printer monitor	Operational
5028	Shared printer message received.	Operational
5029	Shared printer message removed.	Operational
5030	Failed to install printer.	Operational
6001	Initialization_CoreStart	Diagnostic
6002	Initialization_CoreStop	Diagnostic
6003	Initialization_PageStart	Diagnostic
6004	Initialization_PageStop	Diagnostic
6005	Initialization_HomeGroupPageStart	Diagnostic
6006	Initialization_HomeGroupPageStop	Diagnostic
6007	Initialization_AdvancedPageStart	Diagnostic
6008	Initialization_AdvancedPageStop	Diagnostic
6009	Initialization_CreateElevatedObjectsStart	Diagnostic
6010	Initialization_CreateElevatedObjectsStop	Diagnostic
6011	Settings_HomeGroupPageRetrieveStart	Diagnostic
6012	Settings_HomeGroupPageRetrieveStop	Diagnostic
6013	Settings_HomeGroupPageCommitStart	Diagnostic
6014	Settings_HomeGroupPageCommitStop	Diagnostic
6015	Settings_AdvancedPageRetrieveStart	Diagnostic
6016	Settings_AdvancedPageRetrieveStop	Diagnostic
6017	Settings_AdvancedPageCommitStart	Diagnostic
6018	Settings_AdvancedPageCommitStop	Diagnostic
6019	Notification_AvailableToJoin_EventStart	Diagnostic
6020	Notification_AvailableToJoin_EventStop	Diagnostic
6021	Notification_PasskeyChangeRequired_EventStart	Diagnostic
6022	Notification_PasskeyChangeRequired_EventStop	Diagnostic
6023	Notification_MergeRequired_EventStart	Diagnostic
6024	Notification_MergeRequired_EventStop	Diagnostic
6025	Notification_AvailableToJoin_BalloonStart	Diagnostic
6026	Notification_AvailableToJoin_BalloonStop	Diagnostic
6027	Notification_PasskeyChangeRequired_BalloonStart	Diagnostic
6028	Notification_PasskeyChangeRequired_BalloonStop	Diagnostic
6029	Notification_MergeRequired_BalloonStart	Diagnostic
6030	Notification_MergeRequired_BalloonStop	Diagnostic
6031	Action_LaunchCreateJoinStart	Diagnostic
6032	Action_LaunchCreateJoinStop	Diagnostic
7001	Initialization_BeginPageStart	Diagnostic
7002	Initialization_BeginPageStop	Diagnostic
7003	Initialization_PasskeyPageStart	Diagnostic
7004	Initialization_PasskeyPageStop	Diagnostic
7005	Initialization_FinishedPageStart	Diagnostic
7006	Initialization_FinishedPageStop	Diagnostic
7007	Initialization_ConfirmPageStart	Diagnostic
7008	Initialization_ConfirmPageStop	Diagnostic
7009	Action_PasswordGenerationStart	Diagnostic
7010	Action_PasswordGenerationStop	Diagnostic
7011	Action_DoCreateJoinChangeStart	Diagnostic
7012	Action_DoCreateJoinChangeStop	Diagnostic
7017	Initialization_SharingPageStart	Diagnostic
7018	Initialization_SharingPageStop	Diagnostic
8001	The homegroup state has changed.	Operational

Event ID 5001: Core initialization failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Core initialization failed. Details: Core_initialization_failed__Details.

Message #

Core initialization failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5002: Page initialization failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Page initialization failed. Details: Page_initialization_failed__Details Page: Page.

Message #

Page initialization failed.  Details: %1 Page: %2

Fields #

Name	Description
`Error` UnicodeString
`Message` UnicodeString

Event ID 5003: GetHomeGroupStatus failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

GetHomeGroupStatus failed. Details: GetHomeGroupStatus_failed__Details.

Message #

GetHomeGroupStatus failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5004: GetSharingFlags failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

GetSharingFlags failed. Details: GetSharingFlags_failed__Details.

Message #

GetSharingFlags failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5005: PopulateSharedFolderList failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

PopulateSharedFolderList failed. Details: PopulateSharedFolderList_failed__Details.

Message #

PopulateSharedFolderList failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5006: Retrieve network discovery failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve network discovery failed. Details: Error.

Message #

Retrieve network discovery failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5007: Retrieve file sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve file sharing failed. Details: Retrieve_file_sharing_failed__Details.

Message #

Retrieve file sharing failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5008: Retrieve public folder failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve public folder failed. Details: Retrieve_public_folder_failed__Details.

Message #

Retrieve public folder failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5009: Retrieve printer sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve printer sharing failed. Details: Retrieve_printer_sharing_failed__Details.

Message #

Retrieve printer sharing failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5010: Retrieve media sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve media sharing failed. Details: Retrieve_media_sharing_failed__Details.

Message #

Retrieve media sharing failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5011: Commit network discovery failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit network discovery failed. Details: Commit_network_discovery_failed__Details Context: Context.

Message #

Commit network discovery failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5012: Commit file sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit file sharing failed. Details: Commit_file_sharing_failed__Details Context: Context.

Message #

Commit file sharing failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5013: Commit public folder failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit public folder failed. Details: Commit_public_folder_failed__Details Context: Context.

Message #

Commit public folder failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5014: Commit printer sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit printer sharing failed. Details: Commit_printer_sharing_failed__Details Context: Context.

Message #

Commit printer sharing failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5015: Commit media sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit media sharing failed. Details: Commit_media_sharing_failed__Details Context: Context.

Message #

Commit media sharing failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5016: Share folder failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Share folder failed. Details: Share_folder_failed__Details FolderId: FolderId Context: Context.

Message #

Share folder failed.  Details: %1  FolderId: %2  Context: %3

Fields #

Name	Description
`Error` UnicodeString
`guid` GUID
`DWORD` UInt32

Event ID 5017: Retrieve printer sharing failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieve printer sharing failed. Details: Retrieve_printer_sharing_failed__Details.

Message #

Retrieve printer sharing failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5018: Commit password protection failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit password protection failed. Details: Error Context: DWORD.

Message #

Commit password protection failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5020: Commit public folder failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Commit public folder failed. Details: Commit_public_folder_failed__Details Context: Context.

Message #

Commit public folder failed.  Details: %1  Context: %2

Fields #

Name	Description
`Error` UnicodeString
`DWORD` UInt32

Event ID 5021: Retrieving UI status from SSO failed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Retrieving UI status from SSO failed. Details: Error.

Message #

Retrieving UI status from SSO failed.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5022: Failed to initialize homegroup printer monitor.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Failed to initialize homegroup printer monitor. Details: Error.

Message #

Failed to initialize homegroup printer monitor.  Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5023: Successfully installed homegroup printer

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Successfully installed homegroup printer.

Message #

Successfully installed homegroup printer

Event ID 5024: Successfully removed homegroup printer

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Successfully removed homegroup printer.

Message #

Successfully removed homegroup printer

Event ID 5025: Failed to install homegroup printer.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Failed to install homegroup printer. Details: Error.

Message #

Failed to install homegroup printer. Details: %1

Fields #

Name	Description
`Error` UnicodeString

Event ID 5026: Starting printer monitor

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Starting printer monitor.

Message #

Starting printer monitor

Event ID 5027: Stopping printer monitor

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Stopping printer monitor.

Message #

Stopping printer monitor

Event ID 5028: Shared printer message received.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Shared printer message received. Attempting to install.

Message #

Shared printer message received. Attempting to install.

Event ID 5029: Shared printer message removed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Shared printer message removed. Attempting to uninstall.

Message #

Shared printer message removed. Attempting to uninstall.

Event ID 5030: Failed to install printer.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

Failed to install printer. Notifying user.

Message #

Failed to install printer.  Notifying user.

Event ID 6001: Initialization_CoreStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_Core
Opcode: Start

Event ID 6002: Initialization_CoreStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_Core
Opcode: Stop

Event ID 6003: Initialization_PageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_Page
Opcode: Start

Event ID 6004: Initialization_PageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_Page
Opcode: Stop

Event ID 6005: Initialization_HomeGroupPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_HomeGroupPage
Opcode: Start

Event ID 6006: Initialization_HomeGroupPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_HomeGroupPage
Opcode: Stop

Event ID 6007: Initialization_AdvancedPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_AdvancedPage
Opcode: Start

Event ID 6008: Initialization_AdvancedPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_AdvancedPage
Opcode: Stop

Event ID 6009: Initialization_CreateElevatedObjectsStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_CreateElevatedObjects
Opcode: Start

Event ID 6010: Initialization_CreateElevatedObjectsStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_CreateElevatedObjects
Opcode: Stop

Event ID 6011: Settings_HomeGroupPageRetrieveStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_HomeGroupPageRetrieve
Opcode: Start

Event ID 6012: Settings_HomeGroupPageRetrieveStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_HomeGroupPageRetrieve
Opcode: Stop

Event ID 6013: Settings_HomeGroupPageCommitStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_HomeGroupPageCommit
Opcode: Start

Event ID 6014: Settings_HomeGroupPageCommitStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_HomeGroupPageCommit
Opcode: Stop

Event ID 6015: Settings_AdvancedPageRetrieveStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_AdvancedPageRetrieve
Opcode: Start

Event ID 6016: Settings_AdvancedPageRetrieveStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_AdvancedPageRetrieve
Opcode: Stop

Event ID 6017: Settings_AdvancedPageCommitStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_AdvancedPageCommit
Opcode: Start

Event ID 6018: Settings_AdvancedPageCommitStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Settings_AdvancedPageCommit
Opcode: Stop

Event ID 6019: Notification_AvailableToJoin_EventStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_AvailableToJoin_Event
Opcode: Start

Event ID 6020: Notification_AvailableToJoin_EventStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_AvailableToJoin_Event
Opcode: Stop

Event ID 6021: Notification_PasskeyChangeRequired_EventStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_PasskeyChangeRequired_Event
Opcode: Start

Event ID 6022: Notification_PasskeyChangeRequired_EventStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_PasskeyChangeRequired_Event
Opcode: Stop

Event ID 6023: Notification_MergeRequired_EventStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_MergeRequired_Event
Opcode: Start

Event ID 6024: Notification_MergeRequired_EventStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_MergeRequired_Event
Opcode: Stop

Event ID 6025: Notification_AvailableToJoin_BalloonStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_AvailableToJoin_Balloon
Opcode: Start

Event ID 6026: Notification_AvailableToJoin_BalloonStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_AvailableToJoin_Balloon
Opcode: Stop

Event ID 6027: Notification_PasskeyChangeRequired_BalloonStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_PasskeyChangeRequired_Balloon
Opcode: Start

Event ID 6028: Notification_PasskeyChangeRequired_BalloonStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_PasskeyChangeRequired_Balloon
Opcode: Stop

Event ID 6029: Notification_MergeRequired_BalloonStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_MergeRequired_Balloon
Opcode: Start

Event ID 6030: Notification_MergeRequired_BalloonStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Notification_MergeRequired_Balloon
Opcode: Stop

Event ID 6031: Action_LaunchCreateJoinStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_LaunchCreateJoin
Opcode: Start

Event ID 6032: Action_LaunchCreateJoinStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_LaunchCreateJoin
Opcode: Stop

Event ID 7001: Initialization_BeginPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_BeginPage
Opcode: Start

Event ID 7002: Initialization_BeginPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_BeginPage
Opcode: Stop

Event ID 7003: Initialization_PasskeyPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_PasskeyPage
Opcode: Start

Event ID 7004: Initialization_PasskeyPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_PasskeyPage
Opcode: Stop

Event ID 7005: Initialization_FinishedPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_FinishedPage
Opcode: Start

Event ID 7006: Initialization_FinishedPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_FinishedPage
Opcode: Stop

Event ID 7007: Initialization_ConfirmPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_ConfirmPage
Opcode: Start

Event ID 7008: Initialization_ConfirmPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_ConfirmPage
Opcode: Stop

Event ID 7009: Action_PasswordGenerationStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_PasswordGeneration
Opcode: Start

Event ID 7010: Action_PasswordGenerationStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_PasswordGeneration
Opcode: Stop

Event ID 7011: Action_DoCreateJoinChangeStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_DoCreateJoinChange
Opcode: Start

Event ID 7012: Action_DoCreateJoinChangeStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Action_DoCreateJoinChange
Opcode: Stop

Event ID 7017: Initialization_SharingPageStart

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_SharingPage
Opcode: Start

Event ID 7018: Initialization_SharingPageStop

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Diagnostic
Task: Initialization_SharingPage
Opcode: Stop

Event ID 8001: The homegroup state has changed.

Provider: Microsoft-Windows-HomeGroup-ControlPanel
Channel: Operational

Description

The homegroup state has changed. Old state: OldState. New state: NewState.

Message #

The homegroup state has changed. Old state: %2. New state: %3.

Fields #

Name	Description
`hc_stateid` UInt32
`OldState` UnicodeString
`NewState` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 134ea407-755d-4a93-b8a6-f290cd155023

Defined in hgcpl.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)