Analyzing files within Zeek scripts

Zeek
1

Hello, I have interest in making an analysis in which, whenever dns_request event is triggered, the query is compared to other queries, present in a file. In this sense, I would like to know how to make a sequencial read of a file, present in a local directory, in a Zeek script, in order to make the type of comparison I am aiming to do.

I have been reading the documentation about file analysis, however, I am having some difficulties in understand how could I extract the data in a sequencial way and then take further actions based on them.

2

The idiomatic way to do this in Zeek would be to read the file into a set or table using the Input Framework, and then compare the query to that, rather than trying to read elements from the file once per query, which will be difficult to make efficient.