IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
These are the event fields specific to the Sysmon module.
-
sysmon.dns.status
-
Windows status code returned for the DNS query.
type: keyword
-
sysmon.file.archived
-
Indicates if the deleted file was archived.
type: boolean
-
sysmon.file.is_executable
-
Indicates if the deleted file was an executable.
type: boolean