...
Create a simple rule on your Devo Relay that applies the dns.windows tag to all events arriving on a specified port. In the example below, we use port 13003 but you should use any port that you can dedicate to these events.
Source Port → 13003
Target Tag → dns.windows
Check the Stop processing and Sent without syslog tag checkboxes.
