Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Ingestion API Supported | ✓ Yes |
Source: KQL validation test schema
| Column Name | Type |
|---|---|
| AA | string |
| answers | dynamic |
| icann_domain | string |
| icann_host_subdomain | string |
| icann_tld | string |
| id_orig_h | string |
| id_orig_p | int |
| id_resp_h | string |
| id_resp_p | int |
| is_trusted_domain | string |
| num | long |
| path | string |
| proto | string |
| qclass | real |
| qclass_name | string |
| qtype | real |
| qtype_name | string |
| query | string |
| RA | string |
| rcode | long |
| rcode_name | string |
| RD | string |
| rejected | string |
| rtt | real |
| system_name | string |
| TC | string |
| TimeGenerated | datetime |
| trans_id | string |
| ts | datetime |
| TTLs | string |
| Type | string |
| uid | string |
| write_ts | datetime |
| zeek_Z | real |
Official Microsoft Learn documentation for field/column information:
This table is used by the following solutions:
This table is ingested by the following connectors:
| Connector | Selection Criteria |
|---|---|
| Corelight Connector Exporter |
In solution Corelight:
| Analytic Rule | Selection Criteria |
|---|---|
| Corelight - C2 DGA Detected Via Repetitive Failures |
In solution Corelight:
| Hunting Query | Selection Criteria |
|---|---|
| Corelight - Repetitive DNS Failures |
In solution Corelight:
| Workbook | Selection Criteria |
|---|---|
| Corelight | |
| Corelight_Data_Explorer | |
| Corelight_Data_Insights | |
| Corelight_Security_Workflow |
| Parser | Solution | Selection Criteria |
|---|---|---|
| corelight_dns | Corelight | |
| corelight_dns_red | Corelight |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊