Collect AWS Route 53 logs

This document explains how to configure AWS CloudTrail to store AWS Route 53 DNS logs in an S3 bucket and ingest the logs from S3 to Google Security Operations. Amazon Route 53 provides DNS query logging and the ability to monitor your resources using health checks. Route 53 is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Route 53.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• Privileged access to AWS

How to configure AWS Cloudtrail and Route 53

1. Sign in to the AWS Console.
2. Search for Cloudtrail.
3. If you don't already have a trail, click Create trail.

1. Provide a Trail name .
2. Select Create new S3 bucket (you may also choose to use an existing S3 bucket).
3. Provide a name for AWS KMS alias, or choose an existing AWS KMS Key.
4. Leave the other settings as default, and click Next.
5. Select Event type, make sure Management events is selected (these are the events that will include Route 53 API calls).
6. Click Next.
7. Review the settings in Review and create.
8. Click Create trail.
9. In the AWS console, search for S3.
10. Click the newly created log bucket and select the AWSLogs folder .
11. Click Copy S3 URI and save it.

Configure AWS IAM User

1. In the AWS console, search for IAM.
2. Click Users.
3. Click Add Users.
4. Provide a name for the user (for example, chronicle-feed-user).
5. Select Access key - Programmatic access as the AWS credential type.
6. Click Next: Permissions.
7. Select Attach existing policies directly.
8. Select AmazonS3ReadOnlyAccess or AmazonS3FullAccess.

1. Click Next: Tags.
2. Optional: add any tags if required.
3. Click Next: Review.
4. Review the configuration and click Create user.
5. Copy the Access key ID and Secret access key of the created user.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the AWS Route 53 DNS feed

1. Click the Amazon Cloud Platform pack.
2. Locate the AWS Route 53 DNS log type.

3. Specify the values in the following fields.

   • Source Type: Amazon SQS V2
   • Queue Name: The SQS queue name to read from
   • S3 URI: The bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of your S3 bucket.

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • SQS Queue Access Key ID: An account access key that is a 20-character alphanumeric string.

   • SQS Queue Secret Access Key: An account access key that is a 40-character alphanumeric string.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.