diff --git a/synapse/lib/syntax.py b/synapse/lib/syntax.py
index 45916ae0b..c2b154683 100644
--- a/synapse/lib/syntax.py
+++ b/synapse/lib/syntax.py
@@ -17,7 +17,7 @@ tagfilt = varset.union({'#', '*', '@'})
 alphaset = set('abcdefghijklmnopqrstuvwxyz')
 
 # this may be used to meh() potentially unquoted values
-valmeh = whites.union({'(',')','=',',','[',']'})
+valmeh = whites.union({'(', ')', '=', ',', '[', ']'})
 
 def nom(txt, off, cset, trim=True):
     '''
@@ -95,15 +95,14 @@ def parse_list(text, off=0, trim=True):
 
         _, off = nom(text, off, whites)
 
-        valu,off = parse_valu(text, off)
+        valu, off = parse_valu(text, off)
 
         _, off = nom(text, off, whites)
 
-
         # check for foo=bar kw tuple syntax
         if nextchar(text, off, '='):
 
-            _, off = nom(text, off+1, whites)
+            _, off = nom(text, off + 1, whites)
 
             vval, off = parse_valu(text, off)
 
@@ -373,7 +372,7 @@ def parse_ques(text, off=0, trim=True):
 
             if textpart.startswith(ctxt):
                 ques['cmp'] = cmpr
-                ques['valu'], off = parse_oarg(text, off + len(ctxt))
+                ques['valu'], off = parse_valu(text, off + len(ctxt))
                 break
 
         break
@@ -384,7 +383,7 @@ def parse_valu(text, off=0):
     '''
     Special syntax for the right side of equals in a macro
     '''
-    _, off = nom(text,off,whites)
+    _, off = nom(text, off, whites)
 
     if nextchar(text, off, '('):
         return parse_list(text, off)

regex macro filter eats query remainder
seems like string parsing after ~= needs to use the latest function in use by the rest of the macros that can be either whitespace *or* quote bounded.
diff --git a/synapse/tests/test_syntax.py b/synapse/tests/test_syntax.py
index bd22f99c2..aa6f4ced3 100644
--- a/synapse/tests/test_syntax.py
+++ b/synapse/tests/test_syntax.py
@@ -66,7 +66,20 @@ class StormSyntaxTest(SynTest):
         insts = s_syntax.parse('+foo:bar~="hehe" -foo:bar~="hoho"')
         self.eq(insts[0], ('filt', {'prop': 'foo:bar', 'mode': 'must', 'cmp': 're', 'valu': 'hehe'}))
         self.eq(insts[1], ('filt', {'prop': 'foo:bar', 'mode': 'cant', 'cmp': 're', 'valu': 'hoho'}))
-        self.eq({'woot': 10}, {'woot': 10})
+        # Real world example with and without quotes around the regex valu
+        insts = s_syntax.parse('#sig.mal.pennywise totags() +syn:tag~="bhv.aka" fromtags()')
+        self.eq(len(insts), 4)
+        self.eq(insts[0], ('alltag', {'args': ('sig.mal.pennywise',), 'kwlist': []}))
+        self.eq(insts[1], ('totags', {'args': [], 'kwlist': []}))
+        self.eq(insts[2], ('filt', {'cmp': 're', 'prop': 'syn:tag', 'mode': 'must', 'valu': 'bhv.aka'}))
+        self.eq(insts[3], ('fromtags', {'args': [], 'kwlist': []}))
+        # And without quotes
+        insts = s_syntax.parse('#sig.mal.pennywise totags() +syn:tag~=bhv.aka fromtags()')
+        self.eq(len(insts), 4)
+        self.eq(insts[0], ('alltag', {'args': ('sig.mal.pennywise',), 'kwlist': []}))
+        self.eq(insts[1], ('totags', {'args': [], 'kwlist': []}))
+        self.eq(insts[2], ('filt', {'cmp': 're', 'prop': 'syn:tag', 'mode': 'must', 'valu': 'bhv.aka'}))
+        self.eq(insts[3], ('fromtags', {'args': [], 'kwlist': []}))
 
     def test_storm_syntax_by(self):
         insts = s_syntax.parse('woot/foo:bar*baz="hehe"')
@@ -85,16 +98,16 @@ class StormSyntaxTest(SynTest):
         self.eq(insts[0], s_syntax.oper('lift', 'inet:fqdn', '1.2.3.4', by='eq'))
 
     def test_storm_syntax_comp_opts(self):
-        valu,off = s_syntax.parse_valu('(foo,bar,baz=faz)')
-        self.eq( valu, ['foo','bar',('baz','faz')] )
+        valu, off = s_syntax.parse_valu('(foo,bar,baz=faz)')
+        self.eq(valu, ['foo', 'bar', ('baz', 'faz')])
 
-        valu,off = s_syntax.parse_valu('(foo, bar, baz=faz)')
-        self.eq( valu, ['foo','bar',('baz','faz')] )
+        valu, off = s_syntax.parse_valu('(foo, bar, baz=faz)')
+        self.eq(valu, ['foo', 'bar', ('baz', 'faz')])
 
-        valu,off = s_syntax.parse_valu('(   foo   ,    bar   ,   baz    =     faz    )')
-        self.eq( valu, ['foo','bar',('baz','faz')] )
+        valu, off = s_syntax.parse_valu('(   foo   ,    bar   ,   baz    =     faz    )')
+        self.eq(valu, ['foo', 'bar', ('baz', 'faz')])
 
     def test_storm_syntax_edit(self):
         inst0 = s_syntax.parse('[inet:ipv4=127.0.0.1 inet:ipv4=127.0.0.2]')
         inst1 = s_syntax.parse('   [   inet:ipv4   =    127.0.0.1  inet:ipv4   =   127.0.0.2   ]   ')
-        self.eq(inst0,inst1)
+        self.eq(inst0, inst1)

pip install -e .
parse_log_pytest
pytest
pytest codecov
apt-get update apt-get install -y gcc pip install --upgrade pip pip install --upgrade setuptools pip install pycparser pip install cryptography
3.6
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///opt/conda/conda-bld/attrs_1642510447205/work
certifi==2021.5.30
cffi==1.15.1
charset-normalizer==2.0.12
codecov==2.1.13
coverage==6.2
cryptography==40.0.2
idna==3.10
importlib-metadata @ file:///tmp/build/80754af9/importlib-metadata_1631916693255/work
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
lmdb==1.6.2
more-itertools @ file:///tmp/build/80754af9/more-itertools_1637733554872/work
msgpack-python==0.5.6
packaging @ file:///tmp/build/80754af9/packaging_1637314298585/work
pluggy @ file:///tmp/build/80754af9/pluggy_1615976315926/work
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pycparser==2.21
pyOpenSSL==23.2.0
pyparsing @ file:///tmp/build/80754af9/pyparsing_1635766073266/work
pytest==6.2.4
requests==2.27.1
-e git+https://github.com/vertexproject/synapse.git@68aea52a02ab7d24f0c4557c6704da114ab0fbe1#egg=synapse
toml @ file:///tmp/build/80754af9/toml_1616166611790/work
tornado==6.1
typing_extensions @ file:///opt/conda/conda-bld/typing_extensions_1647553014482/work
urllib3==1.26.20
xxhash==3.2.0
zipp @ file:///tmp/build/80754af9/zipp_1633618647012/work

name: synapse
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=21.4.0=pyhd3eb1b0_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - importlib-metadata=4.8.1=py36h06a4308_0
  - importlib_metadata=4.8.1=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - more-itertools=8.12.0=pyhd3eb1b0_0
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - packaging=21.3=pyhd3eb1b0_0
  - pluggy=0.13.1=py36h06a4308_0
  - py=1.11.0=pyhd3eb1b0_0
  - pyparsing=3.0.4=pyhd3eb1b0_0
  - pytest=6.2.4=py36h06a4308_2
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - toml=0.10.2=pyhd3eb1b0_0
  - typing_extensions=4.1.1=pyh06a4308_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.6.0=pyhd3eb1b0_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - cffi==1.15.1
      - charset-normalizer==2.0.12
      - codecov==2.1.13
      - coverage==6.2
      - cryptography==40.0.2
      - idna==3.10
      - lmdb==1.6.2
      - msgpack-python==0.5.6
      - pip==21.3.1
      - pycparser==2.21
      - pyopenssl==23.2.0
      - requests==2.27.1
      - setuptools==59.6.0
      - tornado==6.1
      - urllib3==1.26.20
      - xxhash==3.2.0
prefix: /opt/conda/envs/synapse

synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_regex
synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_basic synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_by synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_comp_opts synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_edit synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_gele synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_lifteq synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_liftlift synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_macro_eq synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_pivot synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_uppercase_and_underscore synapse/tests/test_syntax.py::StormSyntaxTest::test_storm_syntax_whites
synapse/lib/syntax.py
synapse/lib/syntax.py