---
title: Sysmon module fields
description: These are the event fields specific to the Sysmon module. 
url: https://www.elastic.co/elastic/docs-builder/docs/2341/reference/beats/winlogbeat/exported-fields-sysmon
---

# Sysmon module fields
These are the event fields specific to the Sysmon module.
<definitions>
  <definition term="sysmon.dns.status">
    Windows status code returned for the DNS query.
    type: keyword
  </definition>
  <definition term="sysmon.file.archived">
    Indicates if the deleted file was archived.
    type: boolean
  </definition>
  <definition term="sysmon.file.is_executable">
    Indicates if the deleted file was an executable.
    type: boolean
  </definition>
</definitions>