In this article

Admins use this article to combine CyberSight and DNS query export data in a single Microsoft Sentinel table mapping. By default, Microsoft Sentinel accepts only one schema per table mapping, so a connection normally carries either DNS query data or CyberSight data, not both.

Microsoft Sentinel is a third-party product. DNSFilter does not provide official support for Sentinel configuration; refer to Microsoft's own documentation for Sentinel-specific setup steps.

Build a combined table mapping

Complete the following steps to send both data types to the same Sentinel destination:

1. In Microsoft Sentinel, create a custom table mapping that includes every field from both the DNS query and CyberSight schemas listed below. See Microsoft's Sentinel data transformation documentation for steps to create and manage a custom table mapping
2. Send both the CyberSight export and the DNS query export to that same table

Rows from each source populate their own columns, and the columns belonging to the other source remain empty for that row.

DNS query fields

{
  "Allowed": "",
  "ApplicationCategoryID": "",
  "ApplicationCategoryName": "",
  "ApplicationID": "",
  "ApplicationName": "",
  "Blockallowcats": "",
  "Blockcats": "",
  "Client": "",
  "ClientID": "",
  "ClientMac": "",
  "ClientType": "",
  "Code": "",
  "Collection": "",
  "CollectionID": "",
  "Domain": "",
  "FQDN": "",
  "IP4": "",
  "IP6": "",
  "Method": "",
  "Network": "",
  "NetworkID": "",
  "Organization": "",
  "OrganizationID": "",
  "Policy": "",
  "PolicyID": "",
  "PrivacyMode": "",
  "Protocol": "",
  "QuestionType": "",
  "Region": "",
  "RequestAddress": "",
  "ResponseIPs": "",
  "ScheduledPolicy": "",
  "ScheduledPolicyID": "",
  "Secallowcats": "",
  "Seccats": "",
  "Threat": "",
  "Time": "",
  "UserID": "",
  "Username": "",
  "event_type": ""
}

CyberSight fields

{
  "activity_type": "",
  "agent_local_user_id": "",
  "agent_local_user_user_name": "",
  "agent_local_user_uuid": "",
  "app_executable_path": "",
  "app_name": "",
  "app_window_title": "",
  "cybersight_event_type": "",
  "event_end_time_utc": "",
  "event_length_in_seconds": "",
  "event_start_time_utc": "",
  "event_type": "",
  "msp_id": "",
  "msp_uuid": "",
  "org_uuid": "",
  "organization_name": "",
  "privacy_setting": "",
  "remote_ip": "",
  "user_agent_hostname": "",
  "user_agent_id": "",
  "user_agent_uuid": ""
}

Both sets of fields can be included in one mapping, or only one set, depending on which data types need to appear in Sentinel.

Normalize timestamps across both data types

DNS events carry a Time field. CyberSight events carry event_start_time_utc and event_end_time_utc fields, since CyberSight has no single canonical event time — only a start and an end. Apply the following transform in the table's transform editor to produce a consistent TimeGenerated field across both data types:

source
| extend TimeGenerated = iif(isnotnull(Time), todatetime(Time), todatetime(event_end_time_utc))
| project-away Time, event_end_time_utc

The combined table now displays both CyberSight and DNS query events under a single, consistently ordered timestamp.