Collect AWS Route 53 logs

This document explains how to configure AWS CloudTrail to store AWS Route 53 DNS logs in an S3 bucket and ingest the logs from S3 to Google Security Operations. Amazon Route 53 provides DNS query logging and the ability to monitor your resources using health checks. Route 53 is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Route 53.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• Privileged access to AWS

How to configure AWS Cloudtrail and Route 53

1. Sign in to the AWS Console.
2. Search for Cloudtrail.
3. If you don't already have a trail, click Create trail.

1. Provide a Trail name .
2. Select Create new S3 bucket (you may also choose to use an existing S3 bucket).
3. Provide a name for AWS KMS alias, or choose an existing AWS KMS Key.
4. Leave the other settings as default, and click Next.
5. Select Event type, make sure Management events is selected (these are the events that will include Route 53 API calls).
6. Click Next.
7. Review the settings in Review and create.
8. Click Create trail.
9. In the AWS console, search for S3.
10. Click the newly created log bucket and select the AWSLogs folder .
11. Click Copy S3 URI and save it.

Configure AWS IAM User

1. In the AWS console, search for IAM.
2. Click Users.
3. Click Add Users.
4. Provide a name for the user (for example, chronicle-feed-user).
5. Select Access key - Programmatic access as the AWS credential type.
6. Click Next: Permissions.
7. Select Attach existing policies directly.
8. Select AmazonS3ReadOnlyAccess or AmazonS3FullAccess.

1. Click Next: Tags.
2. Optional: add any tags if required.
3. Click Next: Review.
4. Review the configuration and click Create user.
5. Copy the Access key ID and Secret access key of the created user.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds
• Content Hub > Content Packs

Set up feeds from SIEM Settings > Feeds

To configure multiple feeds for different log types within this product family, see Configure feeds by product.

To configure a single feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed (for example, AWS Route 53 Logs).
5. Select Amazon S3 as the Source type.
6. Select AWS Route 53 as the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Region: The region where the Amazon S3 bucket is located.
   • S3 URI: The bucket URI.
     • s3:/BUCKET_NAME
       • Replace BUCKET_NAME with the actual name of your S3 bucket.
   • URI is a: Select Directory which includes subdirectories.
   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Access Key ID: The user's access key with permissions to read from the S3 bucket.

   • Secret Access Key: The user's secret key with permissions to read from the S3 bucket.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

Set up feeds from the Content Hub

Specify values for the following fields:

• Region: The region where the Amazon S3 bucket is located.
• S3 URI: The bucket URI.
  • s3://your-log-bucket-name/
    • Replace your-log-bucket-name with the actual name of your S3 bucket.
• URI is a: Select Directory which includes subdirectories.
• Source deletion options: Select the deletion option according to your ingestion preferences.

• Access Key ID: The user's access key with permissions to read from the S3 bucket.

• Secret Access Key: The user's secret key with permissions to read from the S3 bucket.

Advanced options

• Feed Name: A prepopulated value that identifies the feed.
• Source Type: Method used to collect logs into Google SecOps.
• Asset Namespace: Namespace associated with the feed.
• Ingestion Labels: Labels applied to all events from this feed.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.