search

SwiftOnSecurity / sysmon-config

Sysmon configuration file template with default high-quality event tracing
4.73k stars 1.69k forks source link

DNS Query - Exclude hostname resolution on localhost - EventID 22 #141

Closed ivicaagatunovic closed 3 years ago

ivicaagatunovic commented 3 years ago

In our environment we are using Sysmon v13.01 with enabled Event ID 22 which generated a lot of DNS logs storm. Is it possible to somehow exclude / filter out DNS queries so machine doesn't log localhost resolving. In sysmon logs I see majority of DNS events are coming from machine trying to resolve itself (QueryName: "localmachinename"). The following peace of code under the DNS Query Section in Sysmon config file is already included but doesn't apply since hostnames are unique and doesn't match "localhost" or "localmachine":

<DnsQuery onmatch="exclude"> <QueryName condition="is">..localmachine</QueryName> <QueryName condition="is">localhost</QueryName>

Any ideas how this can be solved?

Thanks, Ivica

SwiftOnSecurity commented 3 years ago

Hi @ivicaagatunovic this has to be a feature request here