|
To achieve the desired event dropping for specific queries based on the raw logs, it is necessary to configure as below:
- Event Type: AO-WUA-DNS-A-Query-Success. DNS logs in Raw event log:
(7)outlook(6)office(3)com(0)
Regex For Office: \(\d+\)outlook\(\d+\)office\(\d+\)com\(\d+\)
- Event Type: AccelOps-WUA-DNS. DNS logs in Raw event log:
(16)onedscolprdeus11(6)eastus(8)cloudapp(5)azure(3)com(0)
Regex for Azure: \(\d+\)cloudapp\(\d+\)azure\(\d+\)com\(\d+\)
- Event Type: AccelOps-WUA-DNS. DNS logs in Raw event log:
(5)teams(9)microsoft(3)com(0)
Regex for Microsoft: \(\d+\)teams\(\d+\)microsoft\(\d+\)com\(\d+\)
This regex filter is working as expected. Performed a lookup query and generated other events from the Windows DNS server.
The events did not appear in the real-time analytics, which aligns with our expectation, since the relevant drop event has been enabled.
|
