Add Sysmon DNS (event ID 22) to module

[andrewkroh]

Add support for Sysmon event ID 22 (DNS Query) added in Sysmon v10. The mapping is

• winlog.event_data.QueryName -> dns.question.name
• winlog.event_data.QueryStatus -> sysmon.dns.status
  • This value is 100% specific to Windows because it's a Windows error code. It might be based on the response code, but it's not exactly the same.
• winlog.event_data.QueryResults -> dns.answers.data, dns.answers.type
• winlog.event_data.QueryResults -> dns.grouped.ip

Sample:

{
    "@timestamp": "2019-07-18T03:34:01.239Z",
    "dns": {
      "answers": [
        {
          "data": "go.microsoft.com.edgekey.net",
          "type": "CNAME"
        },
        {
          "data": "e11290.dspg.akamaiedge.net",
          "type": "CNAME"
        },
        {
          "data": "23.223.14.67",
          "type": "A"
        }
      ],
      "answers_count": 3,
      "grouped": {
        "ip": [
          "23.223.14.67"
        ]
      },
      "question": {
        "length": 16,
        "name": "go.microsoft.com"
      }
    },
    "event": {
      "code": 22,
      "kind": "event"
    },
    "log": {
      "level": "information"
    },
    "process": {
      "entity_id": "{FA4A0DE6-E8A8-5D2F-0000-001094619900}",
      "executable": "C:\\Program Files\\Internet Explorer\\iexplore.exe",
      "name": "iexplore.exe",
      "pid": 356
    },
    "sysmon": {
      "dns": {
        "status": "SUCCESS"
      }
    }
    "winlog": ...
}

[elasticmachine]

Pinging @elastic/secops

[adriansr]

LGTM

[nicpenning]

Hello,

I didn't get any bites on my post in the discuss forums so I will try posting here since I believe it relates. If it does not, please disregard.

Essentially, the DNS Answers type and data (when not an IP address), is not stored in the document. Being able to search/aggregate on Types and Data (include CNAMEs like in the example below) would be very beneficial for security analytics.

https://discuss.elastic.co/t/sysmon-dns-logs-dns-answers-types/213471

I will also add this SysMon DNS query related post as well:

https://discuss.elastic.co/t/sysmon-dns-query-missing-status-codes/213396

This appears to be a status code that is not including in this initial module. If it has since been added this can be ignored. There are probably another 5+ other status codes that are not getting enhanced with the module but I will save those for when I know how you would like to proceed with this one.

Thank you for all the work that your team does there at Elastic!