Sysmon DNS Query Support
I have been trying to generate Sysmon Event ID 22 DNS Query logs using the below xml format
<Sysmon schemaversion="4.90">
<EventFiltering>
<DnsQuery onmatch="exclude" />
</EventFiltering>
</Sysmon>
But I am only able to see logs with QueryResults: type: 5 and not any other number in place of 5. Example values like type: 1, type: 2, type: 3 etc.. How do I generate logs with different numbers for type field in QueryResults? Can you let me know the xml format that can be used to generate them?
Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.