---
title: Sysmon module fields
description: These are the event fields specific to the Sysmon module. 
url: https://www.elastic.co/elastic/docs-builder/docs/3016/reference/beats/winlogbeat/exported-fields-sysmon
products:
  - Beats
  - Winlogbeat
applies_to:
  - Elastic Cloud Serverless: Beta
  - Elastic Stack: Beta
---

# Sysmon module fields
These are the event fields specific to the Sysmon module.
<definitions>
  <definition term="sysmon.dns.status">
    Windows status code returned for the DNS query.
    type: keyword
  </definition>
  <definition term="sysmon.file.archived">
    Indicates if the deleted file was archived.
    type: boolean
  </definition>
  <definition term="sysmon.file.is_executable">
    Indicates if the deleted file was an executable.
    type: boolean
  </definition>
</definitions>