<html lang="en">
<body>
  
  <p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 3</b><br>
		Change log:
		<ul>
			<li>Extra normalizer "JSON event" was changed. Event field "Properties.QNAME" was mapped to the KUMA field "Message". New event enrichment was added. The "Message" event field was mapped to the KUMA field "DestinationAddress" or "DestinationHostName" depending on the conditions of the regular expression.</li>
			<li>Extra normalizer "260" was changed. Mapping of event field "Properties.Destination" was changed from KUMA field "DestinationAddress" to the KUMA field "DeviceCustomIPv6Address2".</li>
			<li>Extra normalizer "279" was changed. Mapping of event field "Properties.Source" was changed from KUMA field "DeviceCustomString1" to the KUMA field "SourceAddress".</li>
			<li>Extra normalizer "256" was changed. Mapping of event field "Properties.Source" was changed from KUMA field "DeviceCustomString1" to the KUMA field "SourceAddress".</li>
			<li>Extra normalizer "257" was changed. Mapping of event field "Properties.RCODE" was changed from KUMA field "FileSize" to the KUMA field "Сode".</li>
			<li>Extra normalizer "257" was changed. New event enrichment was added (conversion DNS response codes to code description).</li>
			<li>New extra normalizer "258" was added.</li>
			<li>New extra normalizer "280" was added.</li>
		</ul>
  </p>
  
   <p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 2</b><br>
	Field mapping was changed in the extra normalizer "JSON event". Event field "System.Channel.Name" was mapped from the KUMA field "DeviceProcessName" to the KUMA field "DeviceEventCategory".
  </p>
  
  <p>
    <b>[OOTB] Microsoft DNS ETW logs json. Version 1</b><br>
	Field mapping was changed in the extra normalizer "JSON event". Event field "Properties.QNAME" was mapped from the KUMA field "SourceHostName" to the KUMA field "DestinationHostName".
  </p>

</body>
</html>