Parser ini memproses log DNS Akamai. Log ini mengekstrak kolom seperti stempel waktu, IP dan port sumber, kueri, jenis data DNS, dan detail respons. Kemudian, kolom ini memetakan kolom tersebut ke UDM, menangani berbagai jenis data DNS dan potensi data SPF. Parser mengklasifikasikan peristiwa sebagai NETWORK_DNSatau GENERIC_EVENT berdasarkan keberadaan informasi utama.
Sebelum memulai
Pastikan Anda memenuhi prasyarat berikut:
Instance Google SecOps.
Akses istimewa ke AWS IAM dan S3.
Akun Akamai Anda memiliki akses ke Layanan Pengiriman Log.
Mengonfigurasi bucket Amazon S3
Buat bucket Amazon S3 dengan mengikuti panduan pengguna ini: Membuat bucket
Simpan Nama dan Region bucket untuk referensi di masa mendatang.
Opsi mencakup per jam, harian, atau setelah mencapai ukuran file tertentu (misalnya, 100 MB).
Opsional: Klik Tambahkan Filter untuk menyertakan atau mengecualikan log tertentu berdasarkan kriteria tertentu (misalnya, nama host atau jenis catatan).
Tinjau detail konfigurasi, lalu klik Simpan dan Aktifkan.
Menyiapkan feed
Untuk mengonfigurasi feed, ikuti langkah-langkah berikut:
Buka Setelan SIEM>Feed.
Klik Tambahkan Feed Baru.
Di halaman berikutnya, klik Konfigurasi satu feed.
Di kolom Feed name, masukkan nama feed (misalnya, Akamai DNS Logs).
Pilih Amazon S3 sebagai Jenis sumber.
Pilih Akamai DNS sebagai Log type.
Klik Berikutnya.
Tentukan nilai untuk parameter input berikut:
Region: region tempat bucket Amazon S3 berada.
URI S3: URI bucket.
s3://BUCKET_NAME
Ganti kode berikut:
BUCKET_NAME: nama bucket.
URI adalah: pilih URI_TYPE sesuai dengan konfigurasi streaming log (File tunggal | Direktori | Direktori yang menyertakan subdirektori).
Opsi penghapusan sumber: pilih opsi penghapusan sesuai preferensi Anda.
Access Key ID: Kunci akses pengguna dengan akses ke bucket s3.
Secret Access Key: kunci rahasia Pengguna dengan akses ke bucket s3.
Label penyerapan: label yang akan diterapkan ke peristiwa dari feed ini.
Klik Berikutnya.
Tinjau konfigurasi feed baru Anda di layar Finalisasi, lalu klik Kirim.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
class
read_only_udm.network.dns.questions.class
Jika class adalah "IN", tetapkan ke 1. Jika tidak, coba konversi ke bilangan bulat yang tidak bertanda tangan.
column11
read_only_udm.target.hostname
Dipetakan jika berisi nama host dan tidak berisi pola tertentu seperti "ip4", "=", ".net", atau "10 mx0". Juga digunakan untuk mengekstrak alamat IP, alamat email, dan data otoritas DNS berdasarkan berbagai pola.
column11
read_only_udm.target.ip
Diekstrak dari column11 jika cocok dengan pola alamat IP dalam data SPF.
column11
read_only_udm.target.user.email_addresses
Diekstrak dari column11 jika cocok dengan pola alamat email dalam data DMARC.
column11
read_only_udm.network.dns.authority.data
Diekstrak dari column11 jika cocok dengan pola nama domain dalam berbagai jenis data.
column11
read_only_udm.network.dns.response_code
Tetapkan ke 3 jika column11 berisi "NXDOMAIN".
column2
read_only_udm.principal.ip
Dipetakan jika merupakan alamat IP yang valid.
column3
read_only_udm.principal.port
Dipetakan jika merupakan bilangan bulat yang valid.
column4
read_only_udm.network.dns.questions.name
Dipetakan secara langsung.
column6
read_only_udm.network.dns.questions.type
Dipetakan berdasarkan nilai type, menggunakan logika bersyarat untuk menetapkan nilai numerik yang sesuai.
column8
read_only_udm.network.sent_bytes
Dikonversi menjadi bilangan bulat yang tidak bertanda dan dipetakan.
read_only_udm.metadata.event_timestamp
Dibuat dari kolom date dan time yang diekstrak dari column1.
read_only_udm.event_type
Tetapkan ke NETWORK_DNS jika principal.ip ada, jika tidak, tetapkan ke GENERIC_EVENT.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis document provides instructions for collecting and parsing Akamai DNS logs within Google SecOps, enabling security teams to monitor and analyze DNS activity.\u003c/p\u003e\n"],["\u003cp\u003eThe setup involves configuring an Amazon S3 bucket to store the logs and an Akamai Log Delivery Service to send the logs to the S3 bucket, ensuring that an IAM user is set with proper permissions.\u003c/p\u003e\n"],["\u003cp\u003eGoogle SecOps ingests Akamai DNS logs via a configured feed, which requires the S3 bucket location and credentials, and supports different URI types and source deletion options.\u003c/p\u003e\n"],["\u003cp\u003eThe parser extracts and maps key data points from Akamai DNS logs, such as timestamps, IP addresses, DNS queries, and response codes, into the Unified Data Model (UDM), categorizing the event as either \u003ccode\u003eNETWORK_DNS\u003c/code\u003e or \u003ccode\u003eGENERIC_EVENT\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration enables the collection of DNS Queries and DNS Responses Logs formats from the Akamai Log Delivery Service, allowing the use of filters to exclude or include specific logs based on various criteria.\u003c/p\u003e\n"]]],[],null,["# Collect Akamai DNS logs\n=======================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser processes Akamai DNS logs. It extracts fields like timestamps, source IP and port, query, DNS record type, and response details. It then maps these fields to the UDM, handling various DNS record types and potential SPF records. The parser classifies the event as either `NETWORK_DNS`or `GENERIC_EVENT` based on the presence of principal information.\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Google SecOps instance.\n- Privileged access to AWS IAM and S3.\n- Your Akamai account has access to the Log Delivery Service.\n\nConfigure an Amazon S3 bucket\n-----------------------------\n\n1. Create an **Amazon S3 bucket** following this user guide: [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html)\n2. Save the bucket **Name** and **Region** for future reference.\n3. Create a **User** following this user guide: [Creating an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console).\n4. Select the created **User**.\n5. Select the **Security credentials** tab.\n6. Click **Create Access Key** in the **Access Keys** section.\n7. Select **Third-party service** as the **Use case**.\n8. Click **Next**.\n9. Optional: Add a description tag.\n10. Click **Create access key**.\n11. Click **Download .csv file** and save the **Access Key** and **Secret Access Key** for future reference.\n12. Click **Done**.\n13. Select the **Permissions** tab.\n14. Click **Add permissions** in the **Permissions policies** section.\n15. Select **Add permissions**.\n16. Select **Attach policies directly**.\n17. Search for and select the **AmazonS3FullAccess** policy.\n18. Click **Next**.\n19. Click **Add permissions**.\n\nConfigure Log Delivery Service in Akamai\n----------------------------------------\n\n1. Sign in to the Akamai Control Center.\n2. Go to **Log Delivery Service** under **Data Services**.\n3. Click **Add New Configuration**.\n4. In the **Configuration Name** field, provide a name for your configuration (for example, **Edge DNS Logs to S3**).\n5. Select **Edge DNS** as the **Log Source**.\n6. Select **AWS S3** as the **Delivery Target**.\n7. Provide the following details:\n - **Bucket Name**: the name of your S3 bucket.\n - **Region**: the AWS region where your bucket is hosted.\n - **Access Key ID**: the IAM user Access Key ID.\n - **Secret Access Key**: the IAM user Secret Access Key.\n - Optional: specify the **Directory Structure** . (for example: `logs/akamai-dns/YYYY/MM/DD/HH/`).\n - Optional: set the **File Naming Convention** . (for example: `edge-dns-logs-{timestamp}.log`).\n8. Select the **Log Formats** you want to include:\n - DNS Queries\n - DNS Responses\n9. Choose the **Delivery Frequency** :\n - Options include hourly, daily, or upon reaching a certain file size (for example, 100MB).\n10. Optional: Click **Add Filters** to include or exclude specific logs based on specific criteria (for example, hostname or record type).\n11. Review the configuration details and click **Save and Activate**.\n\nSet up feeds\n------------\n\nTo configure a feed, follow these steps:\n\n1. Go to **SIEM Settings** \\\u003e **Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed (for example, **Akamai DNS Logs**).\n5. Select **Amazon S3** as the **Source type**.\n6. Select **Akamai DNS** as the **Log type**.\n7. Click **Next**.\n8. Specify values for the following input parameters:\n\n - **Region**: the region where the Amazon S3 bucket is located.\n - **S3 URI**: the bucket URI.\n\n - `s3://BUCKET_NAME`\n\n Replace the following:\n - **BUCKET_NAME**: the name of the bucket.\n - **URI is a** : select the `URI_TYPE` according to log stream configuration (**Single file** \\| **Directory** \\| **Directory which includes subdirectories**).\n\n - **Source deletion option**: select deletion option according to your preference.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Access Key ID**: the User access key with access to the s3 bucket.\n\n - **Secret Access Key**: the User secret key with access to the s3 bucket.\n\n - **Asset namespace** : the [asset namespace](/chronicle/docs/investigation/asset-namespaces).\n\n - **Ingestion labels**: the label to be applied to the events from this feed.\n\n9. Click **Next**.\n\n10. Review your new feed configuration in the **Finalize screen** , and then click **Submit**.\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
