Sysmon module fields
Stack
These are the event fields specific to the Sysmon module.
sysmon.dns.status-
Windows status code returned for the DNS query.
type: keyword
sysmon.file.archived-
Indicates if the deleted file was archived.
type: boolean
sysmon.file.is_executable-
Indicates if the deleted file was an executable.
type: boolean