Microsoft-Windows-RasRoutingProtocols-BGP

52 events across 3 channels

Event	Title	Channel
1	Event ID 1	Operational
1	BGP peering manually started for peer Arg1.	Operational
2	Event ID 2	Operational
2	BGP peering manually started for peer Arg1 of routing domain Arg2.	Operational
3	Event ID 3	Operational
3	BGP peering manually stopped for peer Arg1.	Operational
4	Event ID 4	Operational
4	BGP peering manually stopped for peer Arg1 of routing domain Arg2.	Operational
5	Event ID 5	Operational
5	BGP peering established for peer Arg1.	Operational
6	Event ID 6	Operational
6	BGP peering established for peer Arg1 of routing domain Arg2.	Operational
7	Event ID 7	Operational
7	BGP peering session disconnected for peer Arg1 : Arg2.	Operational
8	Event ID 8	Operational
8	BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.	Operational
9	Event ID 9	Operational
9	BGP peering state changed to Arg1 for peer Arg2.	Debug
10	Event ID 10	Operational
10	BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.	Debug
11	Event ID 11	Operational
11	Maximum prefix limit reached for peer Arg1.	Operational
12	Event ID 12	Operational
12	Maximum prefix limit reached for peer Arg1 of routing domain Arg2.	Operational
13	Event ID 13	Operational
13	BGP peering attempt failed for peer Arg1 : Arg2.	Operational
14	Event ID 14	Operational
14	BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.	Operational
15	Event ID 15	Operational
15	BGP peering collision detected for peer Arg1.	Operational
16	Event ID 16	Operational
16	BGP peering collision detected for peer Arg1 of routing domain Arg2.	Operational
17	Event ID 17	Operational
17	HoldTime set to Arg1 sec for peer Arg2.	Operational
18	Event ID 18	Operational
18	HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.	Operational
19	Event ID 19	Operational
19	TCP connection attempt failed for BGP peer Arg1.	Debug
20	Event ID 20	Operational
20	TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.	Debug
21	Event ID 21	Operational
21	Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3.	Debug
22	Event ID 22	Operational
22	Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of …	Debug
23	Event ID 23	Operational
23	Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing …	Debug
24	Event ID 24	Operational
24	Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded …	Debug
25	Event ID 25	Operational
25	Routes to Arg1, were suppressed from advertisement to peer Arg2 because of …	Debug
26	Event ID 26	Operational
26	Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing …	Debug

Event ID 1:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 1: BGP peering manually started for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer Arg1.

Message #

BGP peering manually started for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 2:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 2: BGP peering manually started for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually started for peer Arg1 of routing domain Arg2.

Message #

BGP peering manually started for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 3:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 3: BGP peering manually stopped for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer Arg1.

Message #

BGP peering manually stopped for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 4:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 4: BGP peering manually stopped for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering manually stopped for peer Arg1 of routing domain Arg2.

Message #

BGP peering manually stopped for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 5:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 5: BGP peering established for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer Arg1.

Message #

BGP peering established for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 6:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 6: BGP peering established for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering established for peer Arg1 of routing domain Arg2.

Message #

BGP peering established for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 7:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 7: BGP peering session disconnected for peer Arg1 : Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer Arg1 : Arg2.

Message #

BGP peering session disconnected for peer %1 : %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 8:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer of routing domain : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 8: BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering session disconnected for peer Arg1 of routing domain Arg2 : Arg3.

Message #

BGP peering session disconnected for peer %1 of routing domain %2 : %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 9:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering state changed to for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 9: BGP peering state changed to Arg1 for peer Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

BGP peering state changed to Arg1 for peer Arg2.

Message #

BGP peering state changed to %1 for peer %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 10:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering state changed to for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 10: BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

BGP peering state changed to Arg1 for peer Arg2 of routing domain Arg3.

Message #

BGP peering state changed to %1 for peer %2 of routing domain %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 11:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 11: Maximum prefix limit reached for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer Arg1.

Message #

Maximum prefix limit reached for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 12:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 12: Maximum prefix limit reached for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Maximum prefix limit reached for peer Arg1 of routing domain Arg2.

Message #

Maximum prefix limit reached for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 13:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 13: BGP peering attempt failed for peer Arg1 : Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer Arg1 : Arg2.

Message #

BGP peering attempt failed for peer %1 : %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 14:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer of routing domain : .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 14: BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering attempt failed for peer Arg1 of routing domain Arg2 : Arg3.

Message #

BGP peering attempt failed for peer %1 of routing domain %2 : %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 15:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 15: BGP peering collision detected for peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer Arg1.

Message #

BGP peering collision detected for peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 16:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 16: BGP peering collision detected for peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

BGP peering collision detected for peer Arg1 of routing domain Arg2.

Message #

BGP peering collision detected for peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 17:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to sec for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 17: HoldTime set to Arg1 sec for peer Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to Arg1 sec for peer Arg2.

Message #

HoldTime set to %1 sec for peer %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 18:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to sec for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 18: HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

HoldTime set to Arg1 sec for peer Arg2 of routing domain Arg3.

Message #

HoldTime set to %1 sec for peer %2 of routing domain %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 19:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

TCP connection attempt failed for BGP peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 19: TCP connection attempt failed for BGP peer Arg1.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

TCP connection attempt failed for BGP peer Arg1.

Message #

TCP connection attempt failed for BGP peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

TCP connection attempt failed for BGP peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20: TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

TCP connection attempt failed for BGP peer Arg1 of routing domain Arg2.

Message #

TCP connection attempt failed for BGP peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 21:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Cannot resolve next-hop for destination , learned from peer . Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 21: Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3. Skipping this route for BGP best path selection until the next-hop is resolvable.

Message #

Cannot resolve next-hop %1 for destination %2, learned from peer %3. Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 22:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Cannot resolve next-hop for destination , learned from peer of routing domain . Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 22: Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of routing domain Arg4.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Cannot resolve next-hop Arg1 for destination Arg2, learned from peer Arg3 of routing domain Arg4. Skipping this route for BGP best path selection until the next-hop is resolvable.

Message #

Cannot resolve next-hop %1 for destination %2, learned from peer %3 of routing domain %4. Skipping this route for BGP best path selection until the next-hop is resolvable.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 23:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , learned from peer were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 23: Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, learned from peer Arg2 were discarded because of ingress routing policy.

Message #

Routes to %1, learned from peer %2 were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 24:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , learned from peer of routing domain were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 24: Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded because of ingress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, learned from peer Arg2 of routing domain Arg3 were discarded because of ingress routing policy.

Message #

Routes to %1, learned from peer %2 of routing domain %3 were discarded because of ingress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 25:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , were suppressed from advertisement to peer because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 25: Routes to Arg1, were suppressed from advertisement to peer Arg2 because of egress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, were suppressed from advertisement to peer Arg2 because of egress routing policy.

Message #

Routes to %1, were suppressed from advertisement to peer %2 because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 26:

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Operational

Description

Routes to , were suppressed from advertisement to peer of routing domain because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 26: Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing domain Arg3 because of egress routing policy.

Provider: Microsoft-Windows-RasRoutingProtocols-BGP
Channel: Debug

Description

Routes to Arg1, were suppressed from advertisement to peer Arg2 of routing domain Arg3 because of egress routing policy.

Message #

Routes to %1, were suppressed from advertisement to peer %2 of routing domain %3 because of egress routing policy.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2e67fcf3-c48e-4b2d-a689-a91d07edb910

Defined in BgpRasMgmt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-RasRoutingProtocols-BGP registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)