The Network DNS name uses a comma-separated string format for Network Accessed event types. This structure replaces the nested JSON array to support keyword searching and data filtering.
This feature requires EDRF Client version 50.2.x or later.
Data format update
The updated data format supports filtering multiple DNS entries within a single query.
Feature | Previous structure | Current structure |
|---|---|---|
Field Name |
|
|
Format | Nested JSON Array of Objects | Comma-Separated String |
Representation |
|
|
Search logic
The New query functionality supports multi-value filtering for network.dnsNames.name. When multiple values are entered, the system applies a Logical OR between entries by default.
Logical query examples:
network.dnsNames.name=proxy.ess.gslb.entsec.comORnetwork.dnsNames.name=us-dnv-essmwg2.corp.entsec.comnetwork.dnsNames.name=proxy.ess.gslb.entsec.comANDnetwork.dnsNames.name=us-dnv-essmwg2.corp.entsec.com
Regular expression examples:
The field supports standard regular expression syntax for pattern matching:
network.dnsNames.name:proxy*network.dnsNames.name:/.*ess.*/network.dnsNames.name:/.*lab/