The SIEM app currently uses DNS data on the Network page and the field names are based on Packetbeat. ECS has now added fields for DNS and the app should be updated to utilize the ECS fields rather than Packetbeat fields.

One change I know that's necessary is to update dns.question.etld_plus_one to dns.question.registered_domain. But we should double check the other fields and areas of the SIEM app.

Work to update Beats is in-progress.