{ "name": "AWSRoute53ResolverCCPDefinition", "apiVersion": "2022-09-01-preview", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { "id": "AWSRoute53ResolverCCPDefinition", "title": "Amazon Web Services S3 DNS Route53 (via Codeless Connector Framework)", "logo": "amazon_web_services_Logo.svg", "publisher": "Microsoft", "descriptionMarkdown": "This connector enables ingestion of AWS Route 53 DNS logs into Microsoft Sentinel for enhanced visibility and threat detection. It supports DNS Resolver query logs ingested directly from AWS S3 buckets, while Public DNS query logs and Route 53 audit logs can be ingested using Microsoft Sentinel's AWS CloudWatch and CloudTrail connectors. Comprehensive instructions are provided to guide you through the setup of each log type. Leverage this connector to monitor DNS activity, detect potential threats, and improve your security posture in cloud environments.", "graphQueriesTableName": "AWSRoute53Resolver", "graphQueries": [ { "metricName": "Total events received", "legend": "Amazon Web Services S3 Resolver query logs", "baseQuery": "{{graphQueriesTableName}}" } ], "sampleQueries": [ { "description": "Get Sample of DNS Resolver query logs", "query": "{{graphQueriesTableName}}\n | take 10" } ], "dataTypes": [ { "name": "{{graphQueriesTableName}}", "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "HasDataConnectors", "value": null } ], "availability": { "status": 1, "isPreview": false }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { "read": true, "write": true, "delete": true, "action": false } }, { "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", "providerDisplayName": "Keys", "scope": "Workspace", "requiredPermissions": { "read": false, "write": false, "delete": false, "action": true } } ] }, "instructionSteps": [ { "title": "AWS Route53", "description": "This connector enables the ingestion of AWS Route 53 DNS logs into Microsoft Sentinel, providing enhanced visibility into DNS activity and strengthening threat detection capabilities. It supports direct ingestion of DNS Resolver query logs from AWS S3 buckets, while Public DNS query logs and Route 53 audit logs can be ingested via Microsoft Sentinel’s AWS CloudWatch and CloudTrail connectors. Detailed setup instructions are provided for each log type. Use this connector to monitor DNS traffic, identify potential threats, and enhance your cloud security posture.\n\nYou can ingest the following type of logs from AWS Route 53 to Microsoft Sentinel:\n1. Route 53 Resolver query logs\n2. Route 53 Public Hosted zones query logs (via Microsoft Sentinel CloudWatch connector)\n3. Route 53 audit logs (via Microsoft Sentinel CloudTrail connector)" }, { "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Ingesting Route53 Resolver query logs in Microsoft Sentinel", "description": "### List of Resources Required:\n\n* Open ID Connect (OIDC) web identity provider\n* IAM Role\n* Amazon S3 Bucket\n* Amazon SQS\n* Route 53 Resolver query logging configuration\n* VPC to associate with Route53 Resolver query log config\n\n", "instructions": [ { "type": "Markdown", "parameters": { "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create). \n 2. Choose the ‘**Specify template**’ option, then ‘**Upload a template file**’ by clicking on ‘**Choose file**’ and selecting the appropriate CloudFormation template file provided below. click ‘**Choose file**’ and select the downloaded template. \n 3. Click '**Next**' and '**Create stack**'." } }, { "type": "CopyableLabel", "parameters": { "label": "Template 1: OpenID connect authentication deployment", "isMultiLine": true, "fillWith": [ "Oidc" ] } }, { "type": "CopyableLabel", "parameters": { "label": "Template 2: AWS Route53 resources deployment", "isMultiLine": true, "fillWith": [ "AWSRoute53Resolver" ] } }, { "type": "Markdown", "parameters": { "content": "### 2. Connect new collectors \n To enable Amazon Web Services S3 DNS Route53 for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." } }, { "type": "DataConnectorsGrid", "parameters": { "mapping": [ { "columnValue": "properties.roleArn", "columnName": "Role ARN" }, { "columnValue": "properties.sqsUrls[0]", "columnName": "Queue URL" } ], "menuItems": [ "DeleteConnector" ] } }, { "type": "ContextPane", "parameters": { "contextPaneType": "DataConnectorsContextPane", "title": "Add new controller", "subtitle": "AWS Security Hub connector", "label": "Add new collector", "instructionSteps": [ { "title": "Account details", "instructions": [ { "type": "Textbox", "parameters": { "label": "Role ARN", "type": "securestring", "name": "roleArn", "validations": { "required": true } } }, { "type": "Textbox", "parameters": { "label": "Queue URL", "type": "securestring", "name": "queueUrl", "validations": { "required": true } } } ] } ] } } ] }, { "title": "Ingesting Route 53 Public Hosted zones query logs (via Microsoft Sentinel CloudWatch connector)", "description": "Public Hosted zone query logs are exported to CloudWatch service in AWS. We can use 'Amazon Web Services S3' connector to ingest CloudWatch logs from AWS to Microsoft Sentinel.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Step 1: Configure logging for Public DNS queries", "description": "1. Sign in to the AWS Management Console and open the Route 53 console at [AWS Route 53](https://console.aws.amazon.com/route53/).\n2. Navigate to Route 53 > Hosted zones.\n3. Choose the Public hosted zone that you want to configure query logging for.\n4. In the Hosted zone details pane, click \"Configure query logging\".\n5. Choose an existing log group or create a new log group.\n6. Choose Create." }, { "title": "Step 2: Configure Amazon Web Services S3 data connector for AWS CloudWatch", "description": "AWS CloudWatch logs can be exported to an S3 bucket using lambda function. To ingest Public DNS queries from `AWS CloudWatch` to `S3` bucket and then to Microsoft Sentinel, follow the instructions provided in the [Amazon Web Services S3 connector](https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3)." } ] }, "type": "InstructionStepsGroup" } ] }, { "title": "Ingesting Route 53 audit logs (via Microsoft Sentinel CloudTrail connector)", "description": "Route 53 audit logs i.e. the logs related to actions taken by user, role or AWS service in Route 53 can be exported to an S3 bucket via AWS CloudTrail service. We can use 'Amazon Web Services S3' connector to ingest CloudTrail logs from AWS to Microsoft Sentinel.", "instructions": [ { "parameters": { "instructionSteps": [ { "title": "Step 1: Configure logging for AWS Route 53 Audit logs", "description": "1. Sign in to the AWS Management Console and open the CloudTrail console at [AWS CloudTrail](https://console.aws.amazon.com/cloudtrail)\n2. If you do not have an existing trail, click on 'Create trail'\n3. Enter a name for your trail in the Trail name field.\n4. Select Create new S3 bucket (you may also choose to use an existing S3 bucket).\n5. Leave the other settings as default, and click Next.\n6. Select Event type, make sure Management events is selected.\n7. Select API activity, 'Read' and 'Write'\n8. Click Next.\n9. Review the settings and click 'Create trail'." }, { "title": "Step 2: Configure Amazon Web Services S3 data connector for AWS CloudTrail", "description": "To ingest audit and management logs from `AWS CloudTrail` to Microsoft Sentinel, follow the instructions provided in the [Amazon Web Services S3 connector](https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3)" } ] }, "type": "InstructionStepsGroup" } ] } ] }, "type": "InstructionStepsGroup" } ] } ], "isConnectivityCriteriasMatchSome": false } } }