Package microsoft/windows-dns-debug Release Notes

Package microsoft/windows-dns-debug Release Notes Version 1.5.1

  • Enhanced timestamp parsing to support additional date format (d/M/yyyy HH:mm:ss)

  • Improved regex pattern for PACKET log entries to handle multiple timestamp formats

  • Fixed timestamp parsing for LOOKUP operation logs

  • Updated parser version to 2.4.1

Package microsoft/windows-dns-debug Release Notes Version 1.5.0

  • Added support for new DNS log format with LOOKUP and RECURSE operations

  • Enhanced DNS answer record parsing with answer name and type extraction

  • Improved thread ID handling with both name and numeric ID fields

  • Added new DNS type classification for answer records

  • Updated parser version to 2.4.0

Package microsoft/windows-dns-debug Release Notes Version 1.4.0

  • Added support for additional timestamp formats (dd.MM.yyyy HH:mm:ss and yyyy-MM-dd HH:mm:ss AM/PM)

  • Enhanced field mapping with separate address, IP, and domain fields for client, destination, server, and source

  • Updated ECS version to 9.2.0 and CPS version to 1.1.0

  • Improved DNS error message mapping with additional error codes

  • Enhanced network type detection for IPv6 addresses

  • Refactored parser logic for better field organization and performance

Package microsoft/windows-dns-debug Release Notes Version 1.3.2

  • Updated ECS version to 9.1.0

  • Removed timezone specification from timestamp parsing

  • Enhanced parser version to 2.2.2

Package microsoft/windows-dns-debug Release Notes Version 1.3.1

  • Improved regex patterns for timestamp parsing

  • Added support for error messages with socket failures

  • Enhanced field extraction for DNS packet information

  • Fixed array handling for DNS header flags

  • Updated parser version to 2.2.1

Package microsoft/windows-dns-debug Release Notes Version 1.3.0

  • Added support for additional log formats

  • Improved handling of DNS debug log header lines

  • Updated ECS version to 8.17.0

  • Enhanced field extraction for DNS packet information

  • Added support for self-referential DNS messages

  • The old parser windows-dns is now officially removed from the Microsoft Windows DNS package

Package microsoft/windows-dns-debug Release Notes Version 1.2.0
Parser renaming and Deprecation notice

The old parser windows-dns is deprecated, and replaced by the new parser microsoft-windows-dns . While the old parser will remain available during a tranisition period, all future changes will only go into the new microsoft-windows-dns parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old windows-dns parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.

Duplicated vendor fields dropped in new parser

The old windows-dns parser would duplicate certain fields, which the new microsoft-windows-dns parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp ), and as a field mapped to CPS (e.g. source.ip ). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:

  • Vendor.EventReceivedTime

  • Vendor.Flags

  • Vendor.Opcode

  • Vendor.PacketID

  • Vendor.QuestionName

  • Vendor.QuestionType

  • Vendor.RemoteIP

  • Vendor.ResponseCode

  • Vendor.SourceModuleName

  • Vendor.ThreadID

  • Vendor.XID

Miscellaneous

  • Sets the fields dns.header_flags as an array.

Package microsoft/windows-dns-debug Release Notes Version 1.1.0

  • Improves the field extraction and performance.

  • Bumps the minimum LogScale version to 1.142 to support assertions in yaml files.

  • Adds new process.thread.id , event.created , network.transport , network.direction , dns.header_flags fields.

  • Mapps Opcode field to dns.op_code .

  • Updates the event.dataset from windows.dns to windows.dns-debug .

  • Sets the event.id based on XID field.

Package microsoft/windows-dns-debug Release Notes Version 1.0.0

  • Adds new event.module , event.dataset and Cps.version fields

  • Removes the Product , related.ip fields

  • Sets following tags: Cps.version , Vendor , ecs.version , event.dataset , event.kind , event.module , event.outcome , observer.type