new to bro, a few questions

Not sure that bro is the best choice for what you're looking for. Bro is
capable of doing what you're asking but this sounds like it may be better
to try out SNORT. Bro is much more usefully for getting a wide variety of
statistics for a wide variety of packets, not just a single DNS packet.


Though if you’re thinking the eventuality of more of bro’s functionality is possibly in your future, there’s something to be said for that. You could retain logs for a couple days or a week, say, and use grep, etc for retaining your query of interest longer. That’s probably easier than going into the config and turning off the default reports, though as Troy points out you can do that.

I’ve never known anyone to say “I wish I didn’t have these data” (though perhaps “I wish they didn’t take up the space”)…