Microsoft-Windows-Store-Client-UI

53 events across 1 channel

Event	Title	Channel
951	User clicked {ControlId} from {ParentPath}.	Operational
952	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
953	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
954	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
955	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
956	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
958	Event ID 958	Operational
959	Event ID 959	Operational
960	Event ID 960	Operational
961	Event ID 961	Operational
962	Event ID 962	Operational
963	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
964	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
965	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
966	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
967	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
968	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
969	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
970	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
971	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
972	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
973	Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store …	Operational
974	Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store …	Operational
975	Event ID 975	Operational
976	Event ID 976	Operational
977	Event ID 977	Operational
978	Event ID 978	Operational
979	Event ID 979	Operational
980	Event ID 980	Operational
981	Event ID 981	Operational
982	Event ID 982	Operational
983	Event ID 983	Operational
984	Event ID 984	Operational
985	Event ID 985	Operational
986	Event ID 986	Operational
987	Event ID 987	Operational
988	Event ID 988	Operational
989	Event ID 989	Operational
990	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
991	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
992	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
993	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
994	{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line …	Operational
995	Event ID 995	Operational
996	Event ID 996	Operational
997	Event ID 997	Operational
998	Event ID 998	Operational
999	Event ID 999	Operational
1000	Event ID 1000	Operational
1001	Event ID 1001	Operational
1002	Event ID 1002	Operational
1003	Event ID 1003	Operational
1004	Event ID 1004	Operational

Event ID 951: User clicked {ControlId} from {ParentPath}.

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

User clicked {ControlId} from {ParentPath}.

Message #

User clicked {ControlId} from {ParentPath}

Fields #

Name	Description
`ControlId`
`ParentPath`

Event ID 952: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 953: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 954: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 955: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 956: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 958:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 959:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 960:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 961:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 962:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 963: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 964: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 965: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 966: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 967: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 968: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 969: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 970: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 971: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 972: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 973: Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store Client Version: {Store Client Version}Store QFE Version: {Store QFE ...

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store Client Version: {Store Client Version}Store QFE Version: {Store QFE Version}.

Message #

Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store Client Version: {Store Client Version}Store QFE Version: {Store QFE Version}

Event ID 974: Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store Client Version: {Store Client Version}Store QFE Version: {Store QFE ...

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Message #

Process Name: {Process Name}Module Name: {Module Name}Build: {Build Name}Store Client Version: {Store Client Version}Store QFE Version: {Store QFE Version}Username: {User Name}Machine Name: {Machine Name}

Event ID 975:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 976:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 977:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 978:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 979:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 980:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 981:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 982:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 983:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 984:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 985:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 986:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 987:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 988:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 989:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 990: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 991: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 992: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 993: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 994: {Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number}).

Message #

{Message}Error: {Error Code}Function: {Function}Source: {Source} ({Line Number})

Fields #

Name	Description
`Message`
`Function`
`Source`

Event ID 995:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 996:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 997:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 998:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 999:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1000:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1001:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1002:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1003:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 1004:

Provider: Microsoft-Windows-Store-Client-UI
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)