Share via

Sysmon DNS Query Support

1357A 0 Reputation points
2023-12-15T05:36:03.6533333+00:00

I have been trying to generate Sysmon Event ID 22 DNS Query logs using the below xml format 

<Sysmon schemaversion="4.90"> 

<EventFiltering> 

<DnsQuery onmatch="exclude" /> 

</EventFiltering> 

</Sysmon>

But I am only able to see logs with QueryResults: type:  5 and not any other number in place of 5. Example values like type:  1, type:  2type:  3 etc.. How do I generate logs with different numbers for type field in QueryResults? Can you let me know the xml format that can be used to generate them?

Sysmon Dns Query Log

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

Windows for business | Windows Client for IT Pros | User experience | Other
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.