<html lang="en">
<body>
  
    <p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 4</b><br>
		Change log:
		<ul>
			<li>Type of the main normalizer was changed from the regexp to json.</li>
			<li>New extra normalizer "Other events" was added.</li>
			<li>Order of the enrichment in the main normalizer was changed.</li>
			<li>New event enrichment with template was added to the KUMA field DeviceCustomNumber1Label in the main normalizer.</li>
		</ul>
	</p>
  
  <p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 3</b><br>
		Change log:
		<ul>
			<li>Extra normalizer "JSON event" was changed. Event field "Properties.QNAME" was mapped to the KUMA field "Message". New event enrichment was added. The "Message" event field was mapped to the KUMA field "DestinationAddress" or "DestinationHostName" depending on the conditions of the regular expression.</li>
			<li>Extra normalizer "260" was changed. Mapping of event field "Properties.Destination" was changed from KUMA field "DestinationAddress" to the KUMA field "DeviceCustomIPv6Address2".</li>
			<li>Extra normalizer "279" was changed. Mapping of event field "Properties.Source" was changed from KUMA field "DeviceCustomString1" to the KUMA field "SourceAddress".</li>
			<li>Extra normalizer "256" was changed. Mapping of event field "Properties.Source" was changed from KUMA field "DeviceCustomString1" to the KUMA field "SourceAddress".</li>
			<li>Extra normalizer "257" was changed. Mapping of event field "Properties.RCODE" was changed from KUMA field "FileSize" to the KUMA field "Сode".</li>
			<li>Extra normalizer "257" was changed. New event enrichment was added (conversion DNS response codes to code description).</li>
			<li>New extra normalizer "258" was added.</li>
			<li>New extra normalizer "280" was added.</li>
		</ul>
	</p>
  
	<p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 2</b><br>
	Field mapping was changed in the extra normalizer "JSON event". Event field "System.Channel.Name" was mapped from the KUMA field "DeviceProcessName" to the KUMA field "DeviceEventCategory".
	</p>
  
	<p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 1</b><br>
	Field mapping was changed in the extra normalizer "JSON event". Event field "Properties.QNAME" was mapped from the KUMA field "SourceHostName" to the KUMA field "DestinationHostName".
	</p>

</body>
</html>