During a threat hunt in Microsoft Defender XDR Advanced Hunting, you suspect that several endpoints are resolving domains associated with a known malware campaign before establishing outbound connections. You want to identify which devices performed DNS queries for the suspicious domain names, including cases where no subsequent TCP/UDP connection succeeded. Which table should you query to reliably capture the DNS query activity?