Not recording SOME dns lookups...

Jason Blakey <[email protected]> Mon, 12 Aug 2019 17:37:15 +0000

Newsgroups	gmane.comp.security.detection.bro
Message-ID	<DB6P18901MB00699101A9976013E93164F388D30@DB6P18901MB0069.EURP189.PROD.OUTLOOK.COM>

Hi all,

 I've got a site that i'm running BRO on that is generating TONS of DNS events.  About 50% of all log file bytes are DNS related.  And most of it is repeated lookup of a single a single domain name.

 Is there any way (maybe using restrict_filters, maybe something else) to NOT log these DNS events for this specific hostname?  I've done some poking around on google, but nothing's jumping out at me.

Thanks,
jason


<https://www.linkedin.com/company/rheagroup>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek