AWSRoute53Resolver

AWSRoute53Resolver Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel This connector enables ingestion of AWS Route 53 DNS logs into Microsoft Sentinel for enhanced visibility and threat detection. It supports DNS Resolver query logs ingested directly from AWS S3 buckets, while Public DNS query logs and Route 53 audit logs can be ingested using Microsoft Sentinel’s AWS CloudWatch and CloudTrail connectors. Comprehensive instructions are provided to guide you through the setup of each log type. Leverage this connector to monitor DNS activity, detect potential threats, and improve your security posture in cloud environments.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AccountId The AWS account ID that owns the VPC which sent the query. String
Answers Array of DNS response records, including resolved IP addresses and other query-related information. Object
FirewallDomainListId ID of the domain list that matched the query domain. String
FirewallRuleAction Rule action from the matching firewall rule. String
FirewallRuleGroupId ID of the firewall rule group that applied to the query. String
LogType Indicates the type of DNS log (e.g. ResolverQueryLogs). String
QueryClass The DNS query class. Usually IN (Internet). String
QueryName The domain name that was queried. String
QueryType The DNS record type requested (e.g. A, AAAA, MX). String
Rcode Textual DNS response code (e.g. NOERROR, NXDOMAIN). String
Region AWS region where the log was generated. String
SourceSystem String
SrcAddr The source IP address of the instance that made the query. String
SrcIds Identifiers related to the source instance where the DNS query originated from or passed through. Object
SrcPort The source port on the instance that made the query. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The time the DNS query was received by Route 53 Resolver. DateTime
Transport The protocol used to send the query (e.g. UDP, TCP, TLS). String
Type The name of the table String
Version Version of the log format. String
VpcId The ID of the VPC where the DNS query originated. String

Schema changes #

Date Action
2026-01-02 Table added to tracking