AWS Route53 Resolver

Scanner supports AWS Route53 Resolver logs, which contain information about DNS queries. In order for Scanner to see these logs, you can configure Route53 Resolver to publish DNS query logs to an S3 bucket that Scanner is linked to.

Collect logs in S3

1

Configure Route53 Resolver to write logs to S3

Follow the AWS documentation to configure the Route53 Resolver to write DNS query logs to an S3 bucket.

See: Resolver query logging.

Create an Index Rule

Once Route53 Resolver logs are landing in your S3 bucket, Create an Index Rule to ingest the logs via Scanner Collect for fast search and detections.