[mrbluecoat]

Can it parse Zeek logs to identify long-running TCP connections and/or identify user attempts to access a DNS blocked domain?

[nikolay_sivko]

We could totally add that, but no one's asked for it so far