This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @Technici4n? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b empty-dns-answer-data upstream/empty-dns-answer-data
git merge upstream/main
git push upstream empty-dns-answer-data

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@Technici4n Are you able to provide a complete event XML (appropriately cleaned of private data) so that we can construct tests for this addition?

Hi, here is a cleaned event:

<Event
	xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
	<System>
		<Provider Name='Microsoft-Windows-Sysmon' Guid='{00000000-0000-0000-0000-000000000000}'/>
		<EventID>22</EventID>
		<Version>5</Version>
		<Level>4</Level>
		<Task>22</Task>
		<Opcode>0</Opcode>
		<Keywords>0x8000000000000000</Keywords>
		<TimeCreated SystemTime='2000-00-00T00:00:00.000Z'/>
		<EventRecordID>1111</EventRecordID>
		<Correlation/>
		<Execution ProcessID='1000' ThreadID='2000'/>
		<Channel>Microsoft-Windows-Sysmon/Operational</Channel>
		<Computer>internal.network.org</Computer>
		<Security UserID='A-0-0-00'/>
	</System>
	<EventData>
		<Data Name='RuleName'>-</Data>
		<Data Name='UtcTime'>2000-00-00T00:00:00.000</Data>
		<Data Name='ProcessGuid'>{00000000-0000-0000-0000-000000000000}</Data>
		<Data Name='ProcessId'>500</Data>
		<Data Name='QueryName'>some.other.domain.com</Data>
		<Data Name='QueryStatus'>0</Data>
		<Data Name='QueryResults'>type:  33 ;type:  33 ;1:2:3::3;1.2.3.3;</Data>
		<Data Name='Image'>C:\Windows\System32\lsass.exe</Data>
		<Data Name='User'>NT AUTHORITY\SYSTEM</Data>
	</EventData>
</Event>

I am not running through winlogbeat directly, but I am reusing its pipelines. This is the error message that I get:
error.message is "Processor \"conditional\" with tag \"\" in pipeline \"winlogbeat-8.8.0-sysmon\" failed with message \"unexpected QueryResult format\""

I've added the test case. Would you resolve the conflict and address the comments? Thanks

/test

/test