URL.Destination.IP is your friend.
As far as adobe updates, the URL for adobe updates typically matches on:
Okay cool. Can this be applied to the access.log? Or will I have to make a new log file? (i really do not want to do that)
Our updates were hitting armdl.adobe.com
As soon as we put that in the Global Block list, the internet came back to life.
You can indeed add that to the access log, but keep in mind if you are using Web Reporter, that you need to update the log file header to match what the actual format is. (the header and your actual log format are currently independent of each other)
See screenshots for what I mean.
Hope it helps!
Thanks Jon, this works great!