What triggers event.type as dns?

Rules
,
1

what triggers event.types to be dns, tls , flow etc other than alerts?

does types like dns, tls etc come under a sub event type category of alert event type?