Sysmon DNS Query Logs - QueryResults Field
1357A
0
Reputation points
How do I display type: 1 for Type A DNS logs in the QueryResults field of Sysmon Event ID 22 DNS Query logs? I tried generating the logs using the below XML format:
<Sysmon schemaversion="4.90">
<EventFiltering>
<DnsQuery onmatch="exclude" />
</EventFiltering>
</Sysmon>
But when I generate Type A DNS logs, the QueryResults field displays as:
QueryResults: 52.206.163.162;34.234.52.18;3.233.126.24;
instead of
QueryResults: type: 1 52.206.163.162;34.234.52.18;3.233.126.24;
Here are the images of the logs generated for reference:
Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
Windows for business | Windows Client for IT Pros | User experience | Other
Sign in to answer