Issues with my DNS Filter

1

Hello,

I’ve been asked to filter our DNS.log to exclude quite a bit of traffic based on the query. Being quite new to the scripting side of Zeek what I’ve attempted to do doesn’t appear to work with wildcards.
In the log entries I have domains ending .com/... with each octet ranging from 1-255, is there a way to filter them all in one string or does it have to be individual entries for each ip address?

Cheers for any assistance.

2

If you can provide your script, this is likely easy to address, but without it I don’t have a fully clear picture of what you’ve tried / want to do.