Sysmon Event ID 22 - Filter localhost DNS queries

Ivica Agatunovic 106 Reputation points

Is it possible to somehow exclude / filter out DNS queries so machine doesn't log localhost resolving. In sysmon logs I see majority of DNS events are coming from machine trying to resolve itself (QueryName: "localmachinename"). The following peace of code under the DNS Query Section in sysmon doesn't seems to work:
<DnsQuery onmatch="exclude">
<QueryName condition="is">..localmachine</QueryName>
<QueryName condition="is">localhost</QueryName>

Any ideas how this can be solved?


Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
919 questions
0 comments No comments
{count} votes

Accepted answer
  1. Ivica Agatunovic 106 Reputation points

    Thanks, I understand the statements part but here problem is that every host is trying to resolve it's own hostname which is unique for each host so if I use only "localhost", statements are useless in this case. I am trying to find a way to completely disable/exclude sysmon DNSquery logging only in case when host tries to resolve itself.

1 additional answer

Sort by: Most helpful
  1. dstaulcu 351 Reputation points

    With current version of Sysmon, the following filter statements are supported:

    • is (default)
    • is not
    • contains
    • contains any
    • is any
    • contains all
    • excludes
    • excludes any
    • excludes all
    • begin with
    • end with
    • less than
    • more than
    • image

    Try incorporating use of "end with" or "contains" instead of "is"

    0 comments No comments