✄𐘗
text code block:
✄𐘗((event.category:(network or network_traffic) and destination.port:53) 
      or network.protocol:"dns" 
      or data_stream.dataset:(network_traffic.dns or zeek.dns)
      or (event.module:corelight and event.dataset:dns))
    and destination.bytes >= 65000
    and event.type:("allowed" or "end" or "protocol" or "start")
and not (
  event.duration > 60000000000
  and (
    event.action:("flow_terminated" or "network_flow")
    or data_stream.dataset:zeek.connection
    or (event.module:corelight and event.dataset:conn)
  )
)