本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
利用 Route 53 全球解析器了解 DNS 活动
Route 53 全球解析器提供全面的 DNS 查询日志记录功能，用于监控客户端设备活动和识别安全威胁。在 Route 53 Global Resolver 中启用 DNS 查询登录功能，以查看客户端设备访问的网站、识别潜在的安全威胁并分析 DNS 解析模式。日志捕获有关每个查询的全面信息，包括应用了哪些安全策略。
DNS 日志中捕获了哪些信息
每个 DNS 查询日志条目都提供有关客户端设备活动和安全策略实施的详细信息：
-
查询信息 -域名、查询类型、查询类和使用的协议
-
客户端设备信息 -源 IP 地址、DNS 视图和身份验证方法
-
响应信息 -响应代码、答案记录和响应时间
-
安全操作 -防火墙规则匹配情况、威胁检测结果和采取的操作
-
元数据 -时间戳、全球解析器 ID、区域和跟踪信息
用于安全集成的 OCSF 格式
DNS 查询日志使用开放网络安全架构框架 (OCSF)，该框架为安全事件数据提供标准化格式。此格式允许：
-
标准化分析 -不同安全工具之间架构一致
-
提高互操作性 -与 SIEM 和分析平台轻松集成
-
增强关联性 -能够将 DNS 事件与其他安全数据关联起来
-
未来的兼容性 -支持不断变化的安全分析需求
OCSF 日志格式示例
Route 53 全球解析器 DNS 查询日志遵循 OCSF 架构结构，提供有关每个 DNS 查询、响应和安全操作的详细信息。以下示例显示允许和拒绝的查询的日志格式。
Route 53 全球解析器 DNS 日志-允许访问示例
此示例显示了通过防火墙规则允许的 DNS 查询。该日志包括查询详情、响应信息和带有 Route 53 Global Resolver-specific 标识符的丰富数据。
{ "action_id": 1, "action_name": "Allowed", "activity_id": 6, "activity_name": "Traffic", "category_name": "Network Activity", "category_uid": 4, "class_name": "DNS Activity", "class_uid": 4003, "cloud": { "provider": "AWS", "region": "us-east-1", "account": { "uid": "123456789012" } }, "connection_info": { "direction": "Inbound", "direction_id": 1, "protocol_name": "udp", "protocol_num": 17, "protocol_ver": "", "uid": "db21d1739ddb423a" }, "duration": 1, "end_time": 1761358379996, "answers": [{ "rdata": "3.3.3.3", "type": "A", "class": "IN", "ttl": 300 }, { "rdata": "3.3.3.4", "type": "A", "class": "IN", "ttl": 300 }], "src_endpoint": { "ip": "3.3.3.1", "port": 56576 }, "enrichments": [{ "name": "global-resolver", "value": "gr-a1b2c3d4fexample", "data": { "dns_view_id": "dnsv-a1b2c3d4fexample", "firewall_rule_id": "fr-a1b2c3d4fexample", "token_id": "t-a1b2c3d4fexample", "token_name": "device-123456", "token_expiration": "1789419206", "access_source_cidr": "3.3.3.0/24", } }], "message": "", "metadata": { "version": "1.2.0", "product": { "name": "Global Resolver", "vendor_name": "AWS", "feature": { "name": "DNS" } } }, "query": { "hostname": "example.com.", "class": "IN", "type": "A", "opcode": "Query", "opcode_id": 0 }, "query_time": 1761358379995, "rcode": "NOERROR", "rcode_id": 0, "response_time": 1761358379995, "severity": "Informational", "severity_id": 1, "src_endpoint": { "ip": "3.3.3.3", "port": 28276 }, "start_time": 1761358379995, "status": "Success", "status_id": 1, "time": 1761358379995, "type_name": "DNS Activity: Traffic", "type_uid": 400306 }
Route 53 全球解析器 DNS 日志-访问被拒绝示例
此示例显示了被防火墙规则阻止的 DNS 查询。该日志包括拒绝操作、空答案数组和表示未处理查询的 REFUSED 响应代码。
{ "action_id": 2, "action_name": "Denied", "activity_id": 6, "activity_name": "Traffic", "category_name": "Network Activity", "category_uid": 4, "class_name": "DNS Activity", "class_uid": 4003, "cloud": { "provider": "AWS", "region": "us-west-2", "account": { "uid": "123456789012" } }, "connection_info": { "direction": "Inbound", "direction_id": 1, "protocol_name": "tcp", "protocol_num": 6, "protocol_ver_id": 4, "uid": "9fdc6fbc09794d5e" }, "duration": 1, "end_time": 1761358379996, "answers": [], "src_endpoint": { "ip": "3.3.3.3", "port": 28276 }, "enrichments": [ { "name": "global-resolver", "value": "gr-a1b2c3d4fexample", "data": { "dns_view_id": "dnsv-a1b2c3d4fexample", "firewall_rule_id": "fr-a1b2c3d4fexample", "token_id": "t-a1b2c3d4fexample", "token_name": "device-123456", "token_expiration": "1789419206", "access_source_cidr": "3.3.3.0/24", } } ], "message": "", "metadata": { "version": "1.2.0", "product": { "name": "Global Resolver", "vendor_name": "AWS", "feature": { "name": "DNS" } } }, "query": { "hostname": "example.com.", "class": "IN", "type": "A", "opcode": "Query", "opcode_id": 0 }, "query_time": 1761358379995, "rcode": "REFUSED", "rcode_id": 5, "response_time": 1761358379995, "severity": "Informational", "severity_id": 1, "start_time": 1761358379995, "status": "Failure", "status_id": 1, "time": 1761358379995, "type_name": "DNS Activity: Traffic", "type_uid": 400306 }
