Microsoft-Windows-Media-Streaming

66 events across 3 channels

Event	Title	Channel
1000	DMR_GetDefaultSettingStart	DMR
1001	DMR_GetDefaultSettingStop	DMR
1002	DMR_RegisterAsDMRStart	DMR
1003	DMR_RegisterAsDMRStop	DMR
1004	DMR_UnregisterAsDMRStart	DMR
1005	DMR_UnregisterAsDMRStop	DMR
1006	DMR_GetDMRUDNStart	DMR
1007	DMR_GetDMRUDNStop	DMR
1008	DMR_OnStateChangedStart	DMR
1009	DMR_OnStateChangedStop	DMR
1010	DMR_GetStateVariablesStart	DMR
1011	DMR_GetStateVariablesStop	DMR
1012	DMR_SetDRMProviderStart	DMR
1013	DMR_SetDRMProviderStop	DMR
1014	DMR_GetMFSupportedPlaybackDLNAProfilesStart	DMR
1015	DMR_GetMFSupportedPlaybackDLNAProfilesStop	DMR
1020	DMR_SetMuteStart	DMR
1021	DMR_SetMuteStop	DMR
1022	DMR_SetVolumeStart	DMR
1023	DMR_SetVolumeStop	DMR
1040	DMR_SetAVTransportURIStart	DMR
1041	DMR_SetAVTransportURIStop	DMR
1042	DMR_PlayStart	DMR
1043	DMR_PlayStop	DMR
1044	DMR_StopStart	DMR
1045	DMR_Stop	DMR
1046	DMR_PauseStart	DMR
1047	DMR_PauseStop	DMR
1048	DMR_SeekStart	DMR
1049	DMR_SeekStop	DMR
1050	DMR_NextStart	DMR
1051	DMR_NextStop	DMR
1052	DMR_PreviousStart	DMR
1053	DMR_PreviousStop	DMR
1054	DMR_SetPlayModeStart	DMR
1055	DMR_SetPlayModeStop	DMR
1056	DMR_InvokeActionStart	DMR
1057	DMR_InvokeActionStop	DMR
1058	DMR_LastChange	DMR
3000	MediaRenderer@Object object created.	DMC
3001	MediaRenderer@Object object destroyed.	DMC
3002	MediaRenderer@Object TransportState=Value.	DMC
3050	AVTransport@Object Play() called.	DMC
3051	AVTransport@Object Pause() called.	DMC
3052	AVTransport@Object Stop() called.	DMC
3053	AVTransport@Object Seek() called.	DMC
3054	AVTransport@Object SetAVTransport() called.	DMC
3055	AVTransport@Object GetTransportInfo() called.	DMC
3056	AVTransport@Object GetPositionInfo() called.	DMC
3057	AVTransport@Object Created SetAVTransportURI async operation with URI=Uri and …	DMC
3058	AVTransport@Object Created SetNextAVTransportURI async operation with URI=Uri …	DMC
3100	ConnectionManager@Object GetProtocolInfo() called.	DMC
3101	MDEServer@Object object created.	MDE
3102	MDEServer@Object object destroyed.	MDE
3103	MDEServer@Object starting server.	MDE
3104	MDEServer@Object server started (hr=ErrorCode).	MDE
3105	MDEServer@Object gathering source metadata.	MDE
3106	MDEServer@Object source metadata gathered (hr=ErrorCode).	MDE
3150	UPnPRequest@Object sending command 'String'.	DMC
3151	UPnPRequest@Object command 'String' completed (hr=ErrorCode).	DMC
3201	Populate_ContextMenuStart	DMC
3202	Populate_ContextMenuStop	DMC
3203	PlayTo_VerifyShouldDisplayStart	DMC
3204	PlayTo_VerifyShouldDisplayStop	DMC
3205	LaunchDMCStart	DMC
3206	LaunchDMCStop	DMC

Event ID 1000: DMR_GetDefaultSettingStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetDefaultSetting
Opcode: Start

Event ID 1001: DMR_GetDefaultSettingStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetDefaultSetting
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1002: DMR_RegisterAsDMRStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_RegisterAsDMR
Opcode: Start

Event ID 1003: DMR_RegisterAsDMRStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_RegisterAsDMR
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1004: DMR_UnregisterAsDMRStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_UnregisterAsDMR
Opcode: Start

Event ID 1005: DMR_UnregisterAsDMRStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_UnregisterAsDMR
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1006: DMR_GetDMRUDNStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetDMRUDN
Opcode: Start

Event ID 1007: DMR_GetDMRUDNStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetDMRUDN
Opcode: Stop

Fields #

Name	Description
`UDN` UnicodeString
`ErrorCode` UInt32

Event ID 1008: DMR_OnStateChangedStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_OnStateChanged
Opcode: Start

Event ID 1009: DMR_OnStateChangedStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_OnStateChanged
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1010: DMR_GetStateVariablesStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetStateVariables
Opcode: Start

Event ID 1011: DMR_GetStateVariablesStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetStateVariables
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1012: DMR_SetDRMProviderStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetDRMProvider
Opcode: Start

Event ID 1013: DMR_SetDRMProviderStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetDRMProvider
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1014: DMR_GetMFSupportedPlaybackDLNAProfilesStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetMFSupportedPlaybackDLNAProfiles
Opcode: Start

Event ID 1015: DMR_GetMFSupportedPlaybackDLNAProfilesStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_GetMFSupportedPlaybackDLNAProfiles
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1020: DMR_SetMuteStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetMute
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32
`String` UnicodeString
`ui32` UInt32

Event ID 1021: DMR_SetMuteStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetMute
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1022: DMR_SetVolumeStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetVolume
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32
`String` UnicodeString
`ui32` UInt32

Event ID 1023: DMR_SetVolumeStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetVolume
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1040: DMR_SetAVTransportURIStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetAVTransportURI
Opcode: Start

Fields #

Name	Description
`URI` UnicodeString
`URIMetadata` UnicodeString

Event ID 1041: DMR_SetAVTransportURIStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetAVTransportURI
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1042: DMR_PlayStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Play
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32
`String` UnicodeString

Event ID 1043: DMR_PlayStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Play
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1044: DMR_StopStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Stop
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32

Event ID 1045: DMR_Stop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Stop
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1046: DMR_PauseStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Pause
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32

Event ID 1047: DMR_PauseStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Pause
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1048: DMR_SeekStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Seek
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32
`String1` UnicodeString
`String2` UnicodeString

Event ID 1049: DMR_SeekStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Seek
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1050: DMR_NextStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Next
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32

Event ID 1051: DMR_NextStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Next
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1052: DMR_PreviousStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Previous
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32

Event ID 1053: DMR_PreviousStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_Previous
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1054: DMR_SetPlayModeStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetPlayMode
Opcode: Start

Fields #

Name	Description
`instanceID` UInt32
`String` UnicodeString

Event ID 1055: DMR_SetPlayModeStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_SetPlayMode
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1056: DMR_InvokeActionStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_InvokeAction
Opcode: Start

Event ID 1057: DMR_InvokeActionStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_InvokeAction
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1058: DMR_LastChange

Provider: Microsoft-Windows-Media-Streaming
Channel: DMR
Task: DMR_LastChange

Fields #

Name	Description
`dispid` UInt32
`ErrorCode` UInt32

Event ID 3000: MediaRenderer@Object object created.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: MediaRenderer_lifetime
Opcode: Start

Description

MediaRenderer@Object object created.

Message #

MediaRenderer@%1 object created

Fields #

Name	Description
`Object` Pointer

Event ID 3001: MediaRenderer@Object object destroyed.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: MediaRenderer_lifetime
Opcode: Stop

Description

MediaRenderer@Object object destroyed.

Message #

MediaRenderer@%1 object destroyed

Fields #

Name	Description
`Object` Pointer

Event ID 3002: MediaRenderer@Object TransportState=Value.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: MediaRenderer

Description

MediaRenderer@Object TransportState=Value.

Message #

MediaRenderer@%1 TransportState=%2

Fields #

Name	Description
`Object` Pointer
`Value` UInt32

Event ID 3050: AVTransport@Object Play() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Play() called.

Message #

AVTransport@%1 Play() called

Fields #

Name	Description
`Object` Pointer

Event ID 3051: AVTransport@Object Pause() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Pause() called.

Message #

AVTransport@%1 Pause() called

Fields #

Name	Description
`Object` Pointer

Event ID 3052: AVTransport@Object Stop() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Stop() called.

Message #

AVTransport@%1 Stop() called

Fields #

Name	Description
`Object` Pointer

Event ID 3053: AVTransport@Object Seek() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Seek() called.

Message #

AVTransport@%1 Seek() called

Fields #

Name	Description
`Object` Pointer

Event ID 3054: AVTransport@Object SetAVTransport() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object SetAVTransport() called.

Message #

AVTransport@%1 SetAVTransport() called

Fields #

Name	Description
`Object` Pointer

Event ID 3055: AVTransport@Object GetTransportInfo() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object GetTransportInfo() called.

Message #

AVTransport@%1 GetTransportInfo() called

Fields #

Name	Description
`Object` Pointer

Event ID 3056: AVTransport@Object GetPositionInfo() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object GetPositionInfo() called.

Message #

AVTransport@%1 GetPositionInfo() called

Fields #

Name	Description
`Object` Pointer

Event ID 3057: AVTransport@Object Created SetAVTransportURI async operation with URI=Uri and Metadata=Metadata.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Created SetAVTransportURI async operation with URI=Uri and Metadata=Metadata.

Message #

AVTransport@%1 Created SetAVTransportURI async operation with URI=%2 and Metadata=%3

Fields #

Name	Description
`Object` Pointer
`Uri` UnicodeString
`Metadata` UnicodeString

Event ID 3058: AVTransport@Object Created SetNextAVTransportURI async operation with URI=Uri and Metadata=Metadata.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: AVTransport

Description

AVTransport@Object Created SetNextAVTransportURI async operation with URI=Uri and Metadata=Metadata.

Message #

AVTransport@%1 Created SetNextAVTransportURI async operation with URI=%2 and Metadata=%3

Fields #

Name	Description
`Object` Pointer
`Uri` UnicodeString
`Metadata` UnicodeString

Event ID 3100: ConnectionManager@Object GetProtocolInfo() called.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: ConnectionManager

Description

ConnectionManager@Object GetProtocolInfo() called.

Message #

ConnectionManager@%1 GetProtocolInfo() called

Fields #

Name	Description
`Object` Pointer

Event ID 3101: MDEServer@Object object created.

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_lifetime
Opcode: Start

Description

MDEServer@Object object created.

Message #

MDEServer@%1 object created

Fields #

Name	Description
`Object` Pointer

Event ID 3102: MDEServer@Object object destroyed.

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_lifetime
Opcode: Stop

Description

MDEServer@Object object destroyed.

Message #

MDEServer@%1 object destroyed

Fields #

Name	Description
`Object` Pointer

Event ID 3103: MDEServer@Object starting server.

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_starttheserver
Opcode: Start

Description

MDEServer@Object starting server.

Message #

MDEServer@%1 starting server

Fields #

Name	Description
`Object` Pointer

Event ID 3104: MDEServer@Object server started (hr=ErrorCode).

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_starttheserver
Opcode: Stop

Description

MDEServer@Object server started (hr=ErrorCode).

Message #

MDEServer@%1 server started (hr=%2)

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 3105: MDEServer@Object gathering source metadata.

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_getthesourcemetadata
Opcode: Start

Description

MDEServer@Object gathering source metadata.

Message #

MDEServer@%1 gathering source metadata

Fields #

Name	Description
`Object` Pointer

Event ID 3106: MDEServer@Object source metadata gathered (hr=ErrorCode).

Provider: Microsoft-Windows-Media-Streaming
Channel: MDE
Task: MediaDeliveryEngine_getthesourcemetadata
Opcode: Stop

Description

MDEServer@Object source metadata gathered (hr=ErrorCode).

Message #

MDEServer@%1 source metadata gathered (hr=%2)

Fields #

Name	Description
`Object` Pointer
`ErrorCode` UInt32

Event ID 3150: UPnPRequest@Object sending command 'String'.

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: UPnPRequest
Opcode: Start

Description

UPnPRequest@Object sending command 'String'.

Message #

UPnPRequest@%1 sending command '%2'

Fields #

Name	Description
`Object` Pointer
`String` UnicodeString

Event ID 3151: UPnPRequest@Object command 'String' completed (hr=ErrorCode).

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: UPnPRequest
Opcode: Stop

Description

UPnPRequest@Object command 'String' completed (hr=ErrorCode).

Message #

UPnPRequest@%1 command '%2' completed (hr=%3)

Fields #

Name	Description
`Object` Pointer
`String` UnicodeString
`ErrorCode` UInt32

Event ID 3201: Populate_ContextMenuStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: Populate_ContextMenu
Opcode: Start

Fields #

Name	Description
`MenuItemCount` UInt32
`ErrorCode` UInt32

Event ID 3202: Populate_ContextMenuStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: Populate_ContextMenu
Opcode: Stop

Fields #

Name	Description
`MenuItemCount` UInt32
`ErrorCode` UInt32

Event ID 3203: PlayTo_VerifyShouldDisplayStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: PlayTo_VerifyShouldDisplay
Opcode: Start

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 3204: PlayTo_VerifyShouldDisplayStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: PlayTo_VerifyShouldDisplay
Opcode: Stop

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 3205: LaunchDMCStart

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: LaunchDMC
Opcode: Start

Fields #

Name	Description
`ItemCount` UInt32
`ErrorCode` UInt32

Event ID 3206: LaunchDMCStop

Provider: Microsoft-Windows-Media-Streaming
Channel: DMC
Task: LaunchDMC
Opcode: Stop

Fields #

Name	Description
`ItemCount` UInt32
`ErrorCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 982824e5-e446-46ae-bc74-836401ffb7b6

Defined in Windows.Media.Streaming.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Microsoft-Windows-Media-Streaming registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Media-Streaming registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)