AWS Route 53

About The Device

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service. You can use Route 53 to perform domain registration and DNS routing. It is designed to give developers and businesses an extremely reliable and cost effective way to route end users to Internet applications.

Device Information

Collection Method

Device Configuration

Adaptive MxDR supports log collection using S3 or SQS.

Prerequisite

• Public DNS query logs are sent directly to the cloudwatch loggroup. Please refer to the following page to create a Cloudwatch loggroup: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html

• Resolver query logs can be sent to an S3 bucket. Please refer to the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

We support two methods to ingest logs into Chronicle from AWS Route 53. The Lambda+S3+SQS method is preferred, while the Data Firehose method is secondary.

Method 1: Lambda+S3+SQS 

To configure logging for DNS queries

1. Sign in to the AWS Management Console and open the Route 53 console at https://console.aws.amazon.com/route53/

2. In the navigation pane, choose Hosted zones.

3. Choose the hosted zone that you want to configure query logging for.

Open

4. Click Configure query logging.

Open

5. In Configure query logging, choose an existing Log group.

6. If you receive an alert about permissions (this happens if you haven't configured query logging with the new console before), do one of the following:

• If you have 10 resource policies already, you can't create any more. Select any of your resource policies, and select Edit . Editing will give Route 53 permissions to write logs to your log groups. Choose Save. The alert goes away and you can continue to the next step.

• If you have never configured query logging before (or if you haven't created 10 resource policies already), you need to grant permissions to Route 53 to write logs to your CloudWatch Logs groups. Choose Grant permissions. The alert goes away and you can continue to the next step.

7. Click Create.

To configure logging for resolver queries

1. Sign in to the AWS Management Console and open the Route 53 console at https://console.aws.amazon.com/route53/

2. In the navigation pane, in Resolver select Query logging.

3. Select configure query logging.

4. In Configure query logging, provide name for your configuration.

5. Select Destination for query logs as S3 bucket.

7. After selecting the destination, please select VPCs to log queries for: (Resolver logs DNS queries that originate in the VPCs that you choose here.)

   • Select Add VPC.

   • Select your VPC and click Add.

8. Add tags as per your organization policy and select configure query logging.

Please follow below steps to attach SQS with S3:

• Follow all the steps provided above to enable logging to S3.

• Create SQS and attach it with S3. Please refer: Configuring AWS Simple Queue Service (SQS) with S3 Storage

Method 2: Amazon Data Firehose

Please find more details on Firehose Configuration on the below page:

Amazon Data Firehose to Chronicle: C2C-Push

Important links:

• Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

IAM User and KMS Key Policies Required for AWS

• For more details on how to get required credentials for integration parameters please refer:

Get Credentials for AWS Storage

• Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

  • IAM: For any logging source IAM URL should be allowed : https://docs.aws.amazon.com/general/latest/gr/iam-service.html

  • S3: For S3 or SQS logging source, S3 URL should be allowed: https://docs.aws.amazon.com/general/latest/gr/s3.html

  • SQS: For SQS logging source, SQS URL should be allowed: https://docs.aws.amazon.com/general/latest/gr/sqs-service.html

Integration Parameters

SQS:

Integration via Amazon Data Firehose:

Configure Amazon Data Firehose on Google Chronicle instance and copy a Endpoint URL & Secret key.