Parsers and Generated Fields
Tag Fields Created by Parser microsoft-windows-dns
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser microsoft-windows-dns
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| __timestamp | @timestamp | Event timestamp extracted and parsed from the raw log line | Parsed from `__timestamp` using `__timestamp match` block with five format patterns |
| Vendor.RemoteIP, Vendor.IP | client.address | Client address (DNS requester) | Conditionally set to Vendor.RemoteIP (Snd+response or Rcv+question) or Vendor.IP (Note log type) |
| client.address (indirect) | client.domain | Client domain name | Copied from client.address when it is not a valid IP |
| client.address (indirect) | client.ip | Client IP address | Copied from client.address when it is a valid IP (CIDR match) |
| Vendor.RemoteIP | destination.address | Destination address of the DNS packet | Conditionally set to Vendor.RemoteIP when Direction=Snd and dns.type=question, or Direction=Snd and dns.type=response |
| destination.address (indirect) | destination.domain | Destination domain name | Copied from destination.address when it is not a valid IP |
| destination.address (indirect) | destination.ip | Destination IP address | Copied from destination.address when it is a valid IP (CIDR match) |
| Vendor.EventDescription (indirect) | dns.answers[0].name | DNS answer record name | Copied from Vendor.AnswerName extracted via regex from Vendor.EventDescription |
| Vendor.EventDescription (indirect) | dns.answers[0].type | DNS answer record type | Copied from Vendor.AnswerType extracted via regex from Vendor.EventDescription |
| Vendor.Flags | dns.header_flags[] | DNS header flags array | Array populated from Vendor.Flags (whitespace stripped via replace) |
| Vendor.PacketID | dns.id | DNS packet identifier | Copied from Vendor.PacketID |
| Vendor.Opcode | dns.op_code | DNS operation code | Copied from Vendor.Opcode |
| Vendor.QuestionName | dns.question.name | DNS question domain name | Parsed from Vendor.QuestionName with regex replacements to convert encoded label format to dotted notation |
| Vendor.QuestionType | dns.question.type | DNS question record type | Copied from Vendor.QuestionType |
| Vendor.ResponseCode | dns.response_code | DNS response code | Copied from Vendor.ResponseCode |
| Vendor.QR, dns.answers[0].type | dns.type | DNS message type classification | Array populated based on Vendor.QR (R โ response), dns.answers[0].type presence (โ answer), otherwise โ question |
| None | ecs.version | ECS schema version | Static value: 9.4.0 |
| dns.response_code (indirect) | error.message | Human-readable error description for DNS failures | Mapped from dns.response_code using match statement (e.g., NXDOMAIN โ Name error, FORMERR โ Format error) |
| @rawstring | error.reason | Socket or connection failure reason | Extracted from Note-type log lines using regex pattern capturing text after "Note:" |
| None | event.category[] | Event category array | Array populated with static value: network |
| Vendor.EventReceivedTime | event.created | Timestamp when the event was received | Copied from Vendor.EventReceivedTime |
| None | event.dataset | Event dataset identifier | Static value: windows.dns-debug |
| Vendor.XID | event.id | DNS transaction ID (XID) from the packet | Copied from Vendor.XID |
| None | event.kind | Event categorization kind | Static value: event |
| None | event.module | Event module identifier | Static value: windows |
| None | event.type[] | Event type array | Array populated with static value: protocol |
| Vendor.Direction | network.direction | Direction of the DNS network packet | Mapped from Vendor.Direction: Snd โ outbound, Rcv โ inbound |
| Vendor.Protocol | network.transport | Network transport protocol (udp or tcp) | Copied from Vendor.Protocol with lowercase transformation |
| Vendor.RemoteIP | network.type | Network address type (ipv4 or ipv6) | Determined by CIDR matching on Vendor.RemoteIP: IPv4 subnet โ ipv4, IPv6 subnet or ::1 โ ipv6 |
| Vendor.ThreadID | process.thread.id | DNS server process thread ID as integer | Parsed from Vendor.ThreadID using parseInt function |
| Vendor.ThreadID | process.thread.name | DNS server process thread name (hex thread ID) | Copied from Vendor.ThreadID |
| Vendor.RemoteIP | server.address | Server address (DNS server) | Conditionally set to Vendor.RemoteIP when Direction=Snd and dns.type=question, or Direction=Rcv and dns.type=response |
| server.address (indirect) | server.domain | Server domain name | Copied from server.address when it is not a valid IP |
| server.address (indirect) | server.ip | Server IP address | Copied from server.address when it is a valid IP (CIDR match) |
| Vendor.RemoteIP | source.address | Source address of the DNS packet | Conditionally set to Vendor.RemoteIP when Direction=Rcv and dns.type=question, or Direction=Rcv and dns.type=response |
| source.address (indirect) | source.domain | Source domain name | Copied from source.address when it is not a valid IP |
| source.address (indirect) | source.ip | Source IP address | Copied from source.address when it is a valid IP (CIDR match) |