DNS activity ASIM parser for Sysmon for Windows
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimDnsMicrosoftSysmonWindowsEvent |
| Built-in Parser | _ASim_Dns_MicrosoftSysmonWindowsEvent |
| Schema | Dns |
| Schema Version | 0.1.7 |
| Parser Type | 🔌 Source (product-specific) |
| Product | Microsoft Windows Events Sysmon |
| Parser Version | 0.5.1 (version history) |
| Last Updated | Jul 19, 2024 |
| Unifying Parser | ASimDns |
| Source File | Parsers\ASimDns\Parsers\ASimDnsMicrosoftSysmonWindowsEvent.yaml |
Description
This ASIM parser supports normalizing Sysmon for Windows DNS logs (event number 22) logs ingested in 'Event' table to the ASIM Dns normalized schema.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
WindowsEvent |
EventID == "22"Provider == "Microsoft-Windows-Sysmon" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
| Connector | Solution |
|---|---|
| WindowsForwardedEvents | Windows Forwarded Events |
Solutions: Windows Forwarded Events
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊