This connector enables ingestion of AWS Route 53 DNS logs into Microsoft Sentinel for enhanced visibility and threat detection. It supports DNS Resolver query logs ingested directly from AWS S3 buckets, while Public DNS query logs and Route 53 audit logs can be ingested using Microsoft Sentinel’s AWS CloudWatch and CloudTrail connectors. Comprehensive instructions are provided to guide you through the setup of each log type. Leverage this connector to monitor DNS activity, detect potential threats, and improve your security posture in cloud environments.
Schema
Name
Description
Type
_BilledSize
Double
_IsBillable
String
AccountId
The AWS account ID that owns the VPC which sent the query.
String
Answers
Array of DNS response records, including resolved IP addresses and other query-related information.
Object
FirewallDomainListId
ID of the domain list that matched the query domain.
String
FirewallRuleAction
Rule action from the matching firewall rule.
String
FirewallRuleGroupId
ID of the firewall rule group that applied to the query.
String
LogType
Indicates the type of DNS log (e.g. ResolverQueryLogs).
String
QueryClass
The DNS query class. Usually IN (Internet).
String
QueryName
The domain name that was queried.
String
QueryType
The DNS record type requested (e.g. A, AAAA, MX).
String
Rcode
Textual DNS response code (e.g. NOERROR, NXDOMAIN).
String
Region
AWS region where the log was generated.
String
SourceSystem
String
SrcAddr
The source IP address of the instance that made the query.
String
SrcIds
Identifiers related to the source instance where the DNS query originated from or passed through.
Object
SrcPort
The source port on the instance that made the query.
String
TenantId
Unique identifier of the tenant into which the data connector ingests data.
String
TimeGenerated
The time the DNS query was received by Route 53 Resolver.
DateTime
Transport
The protocol used to send the query (e.g. UDP, TCP, TLS).