In this article

By default, Microsoft Sentinel accepts only one schema per table mapping, so a connection normally carries either DNS query data or CyberSight data, not both. Admins can combine CyberSight and DNS query export data in a single Microsoft Sentinel table mapping.

Microsoft Sentinel is a third-party product. DNSFilter does not provide official support for Sentinel configuration. See Microsoft's own documentation for Sentinel-specific setup steps.

Build a combined table mapping

To send both data types to the same Sentinel destination:

1. In Microsoft Sentinel, create a custom table mapping that includes every field from both the DNS query and CyberSight schemas listed below. 

   See Microsoft's Sentinel data transformation documentation for steps to create and manage a custom table mapping.

2. Send both the CyberSight export and the DNS query export to that same table.

Rows from each source populate their own columns, and the columns belonging to the other source remain empty for that row.

Both sets of fields can be included in one mapping, or only one set, depending on which data types need to appear in Sentinel.

DNS query fields

{
  "Allowed": "",
  "ApplicationCategoryID": "",
  "ApplicationCategoryName": "",
  "ApplicationID": "",
  "ApplicationName": "",
  "Blockallowcats": "",
  "Blockcats": "",
  "Client": "",
  "ClientID": "",
  "ClientMac": "",
  "ClientType": "",
  "Code": "",
  "Collection": "",
  "CollectionID": "",
  "Domain": "",
  "FQDN": "",
  "IP4": "",
  "IP6": "",
  "Method": "",
  "Network": "",
  "NetworkID": "",
  "Organization": "",
  "OrganizationID": "",
  "Policy": "",
  "PolicyID": "",
  "PrivacyMode": "",
  "Protocol": "",
  "QuestionType": "",
  "Region": "",
  "RequestAddress": "",
  "ResponseIPs": "",
  "ScheduledPolicy": "",
  "ScheduledPolicyID": "",
  "Secallowcats": "",
  "Seccats": "",
  "Threat": "",
  "Time": "",
  "UserID": "",
  "Username": "",
  "event_type": ""
}

CyberSight fields

{
  "activity_type": "",
  "agent_local_user_id": "",
  "agent_local_user_user_name": "",
  "agent_local_user_uuid": "",
  "app_executable_path": "",
  "app_name": "",
  "app_window_title": "",
  "cybersight_event_type": "",
  "event_end_time_utc": "",
  "event_length_in_seconds": "",
  "event_start_time_utc": "",
  "event_type": "",
  "msp_id": "",
  "msp_uuid": "",
  "org_uuid": "",
  "organization_name": "",
  "privacy_setting": "",
  "remote_ip": "",
  "user_agent_hostname": "",
  "user_agent_id": "",
  "user_agent_uuid": ""
}

Normalize timestamps across both data types

DNS events carry a Time field. CyberSight events carry event_start_time_utc and event_end_time_utc fields, because CyberSight has no single canonical event time, only a start and an end.

Apply the following transform in the table's transform editor to produce a consistent TimeGenerated field across both data types.

source
| extend TimeGenerated = iif(isnotnull(Time), todatetime(Time), todatetime(event_end_time_utc))
| project-away Time, event_end_time_utc

The combined table now displays both CyberSight and DNS query events under a single, consistently ordered timestamp.