﻿---
title: Sysmon module fields
description: These are the event fields specific to the Sysmon module. 
url: https://docs-v3-preview.elastic.dev/elastic/beats/pull/47883/reference/winlogbeat/exported-fields-sysmon
---

# Sysmon module fields
These are the event fields specific to the Sysmon module.
<definitions>
  <definition term="sysmon.dns.status">
    Windows status code returned for the DNS query.
    type: keyword
  </definition>
  <definition term="sysmon.file.archived">
    Indicates if the deleted file was archived.
    type: boolean
  </definition>
  <definition term="sysmon.file.is_executable">
    Indicates if the deleted file was an executable.
    type: boolean
  </definition>
</definitions>