im new to this elk world and im currently working on a threat hunting project with ELK/Zeek.
My problem is, that i want for example to query for DNS.Length > 75 within zeek data. I know that its easy to do in splunk, but how to do it with KQL ? I cant find this variable there with length. I just found some script answers, which im not sure about how to use and where to put scripts etc. Any help would be appreciated.