Handle empty sysmon DNS answer data

CHANGELOG.next.asciidoc

@@ -31,6 +31,10 @@ https://github.com/elastic/beats/compare/v8.7.1\...main[Check the HEAD diff]
 *Winlogbeat*
 
 - Add "event.category" and "event.type" to Sysmon module for EventIDs 8, 9, 19, 20, 27, 28, 255 {pull}35193[35193]
+- Corrects issue with security events with source IP of "LOCAL" or "Unknown" failing to ingest {issue}19627[19627] {pull}34295[34295]
+- Added processing for Windows Event ID's 4797, 5379, 5380, 5381, and 5382 for the Security Ingest Pipeline {issue}34293[34293] {pull}34294[34294]
+- Added processing for Windows Event ID's 5140 and 5145 for the Security Ingest Pipeline {pull}34352[34352]
+- Handle empty DNS answer data in QueryResults for the Sysmon Pipeline {pull}35207[35207]
 
 *Functionbeat*
 

x-pack/winlogbeat/module/sysmon/ingest/sysmon.yml

@@ -782,15 +782,22 @@ processors:
 
           if (answer.startsWith("type:")) {
             def parts = /\s+/.split(answer);
-            if (parts.length != 3) {
+
+            if (parts.length == 3) {
+              answers.add([
+                "type": params[parts[1]],
+                "data": parts[2]
+              ]);
+              relatedHosts.add(parts[2]);
+            } else if (parts.length == 2) {
+              // Missing data, for example with "type:  33 ;"
+              answers.add([
+                "type": params[parts[1]],
+                "data": ""
+              ]);
+            } else {
               throw new Exception("unexpected QueryResult format");
             }
-
-            answers.add([
-              "type": params[parts[1]],
-              "data": parts[2]
-            ]);
-            relatedHosts.add(parts[2]);
           } else {
             answer = answer.replace("::ffff:", "");
             ips.add(answer);

x-pack/winlogbeat/module/sysmon/test/testdata/collection/sysmon-no-evtx.evtx.golden.json

@@ -0,0 +1,47 @@
+[
+  {
+    "event": {
+      "code": "22",
+      "kind": "event",
+      "provider": "Microsoft-Windows-Sysmon"
+    },
+    "host": {
+      "name": "internal.network.org"
+    },
+    "log": {
+      "level": "information"
+    },
+    "winlog": {
+      "channel": "Microsoft-Windows-Sysmon/Operational",
+      "computer_name": "internal.network.org",
+      "event_data": {
+        "Image": "C:\\Windows\\System32\\lsass.exe",
+        "ProcessGuid": "{00000000-0000-0000-0000-000000000000}",
+        "ProcessId": "500",
+        "QueryName": "some.other.domain.com",
+        "QueryResults": "type:  33 ;type:  33 ;1:2:3::3;1.2.3.3;",
+        "QueryStatus": "0",
+        "RuleName": "-",
+        "User": "NT AUTHORITY\\SYSTEM",
+        "UtcTime": "2000-01-01T00:00:00.000"
+      },
+      "event_id": "22",
+      "level": "information",
+      "opcode": "Info",
+      "process": {
+        "pid": 1000,
+        "thread": {
+          "id": 2000
+        }
+      },
+      "provider_guid": "{00000000-0000-0000-0000-000000000000}",
+      "provider_name": "Microsoft-Windows-Sysmon",
+      "record_id": 1111,
+      "time_created": "2000-01-01T00:00:00Z",
+      "user": {
+        "identifier": "A-0-0-00"
+      },
+      "version": 5
+    }
+  }
+]