Technical Tip: How to write a regular expressions (regex) for DNS queries in event dropping rule

To achieve the desired event dropping for specific queries based on the raw logs, it is necessary to configure as below:

1. Event Type: AO-WUA-DNS-A-Query-Success. DNS logs in Raw event log:

(7)outlook(6)office(3)com(0)

Regex For Office: \(\d+\)outlook\(\d+\)office\(\d+\)com\(\d+\)

2. Event Type: AccelOps-WUA-DNS. DNS logs in Raw event log:

(16)onedscolprdeus11(6)eastus(8)cloudapp(5)azure(3)com(0)

Regex for Azure: \(\d+\)cloudapp\(\d+\)azure\(\d+\)com\(\d+\)

3. Event Type: AccelOps-WUA-DNS. DNS logs in Raw event log:

       (5)teams(9)microsoft(3)com(0)

Regex for Microsoft: \(\d+\)teams\(\d+\)microsoft\(\d+\)com\(\d+\)

4. Event Type: SensorGroupingTags/ABC as a tag in the raw event log for regex:

(?s)^(?!.*SensorGroupingTags.*ABC).*

If this does not work, check it with the following:

(?s)^(?!.*"SensorGroupingTags".*ABC).*
 

This regex filter is working as expected. It performed a lookup query and generated other events from the Windows DNS server.

The events did not appear in the real-time analytics, which aligns with expectations, since the relevant drop event has been enabled.