Parsers and Generated Fields
Tag Fields Created by Parser microsoft-windows-dns
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser microsoft-windows-dns
| Vendor Field | CPS Field | Description |
|---|---|---|
| `dns.header_flags[]` | Array | Vendor.Flags |
| `client.ip` | Conditionally | Vendor.RemoteIP, Vendor.IP |
| `destination.ip` | Conditionally | Vendor.RemoteIP |
| `server.ip` | Conditionally | Vendor.RemoteIP |
| `source.ip` | Conditionally | Vendor.RemoteIP |
| `dns.id` | Copied | Vendor.PacketID |
| `dns.op_code` | Copied | Vendor.Opcode |
| `dns.question.type` | Copied | Vendor.QuestionType |
| `dns.response_code` | Copied | Vendor.ResponseCode |
| `event.created` | Copied | Vendor.EventReceivedTime |
| `event.id` | Copied | Vendor.XID |
| `network.transport` | Copied | Vendor.Protocol |
| `process.thread.id` | Copied | Vendor.ThreadID |
| `dns.type` | Determined | Vendor.QR |
| `network.type` | Determined | Vendor.RemoteIP |
| `error.reason` | Extracted | error.reason |
| `error.message` | Mapped | dns.response_code |
| `network.direction` | Mapped | Vendor.Direction |
| `@timestamp` | Parsed | timestamp |
| `dns.question.name` | Parsed | Vendor.QuestionName |
| `ecs.version` | Static | None |
| `event.category[]` | Static | None |
| `event.dataset` | Static | None |
| `event.kind` | Static | None |
| `event.module` | Static | None |
| `event.type[]` | Static | None |
| Vendor.IP | client.ip | |
| Vendor.RemoteIP | client.ip | |
| Vendor.PacketID | dns.id | |
| Vendor.Opcode | dns.op_code | |
| Vendor.QuestionName | dns.question.name | |
| Vendor.QuestionType | dns.question.type | |
| Vendor.ResponseCode | dns.response_code | |
| Vendor.EventReceivedTime | event.created | |
| Vendor.XID | event.id | |
| Vendor.Protocol | network.transport | |
| Vendor.ThreadID | process.thread.id | |
| Vendor.RemoteIP | server.ip |