Share via

Sysmon DNS Query Logs - QueryResults Field

1357A 0 Reputation points
2024-03-11T04:05:38.8966667+00:00

How do I display type: 1 for Type A DNS logs in the QueryResults field of Sysmon Event ID 22 DNS Query logs? I tried generating the logs using the below XML format:

<Sysmon schemaversion="4.90">  
<EventFiltering>  
    <DnsQuery onmatch="exclude" />  
</EventFiltering>  
</Sysmon>

But when I generate Type A DNS logs, the QueryResults field displays as:

QueryResults: 52.206.163.162;34.234.52.18;3.233.126.24;

instead of

QueryResults: type: 1 52.206.163.162;34.234.52.18;3.233.126.24;

Here are the images of the logs generated for reference:

1

Sysmon Dns Query logs

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

Windows for business | Windows Client for IT Pros | User experience | Other
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.