# Cisco Umbrella DNS Logs via S3 Setup (Console)

If you have already configured your Cisco Umbrella DNS Logs be stored in an AWS S3 bucket these steps can have them ingested into Fusion:

1. Enable Cisco Umbrella DNS Log Export to S3: Configure Cisco Umbrella to export DNS logs to an AWS S3 bucket.
2. Cisco Umbrella DNS Query Log Source in Fusion: Add a Cisco Umbrella DNS traffic source in Fusion for each log source.

You will need the following information to configure Fusion:

| Field              | Description                                         | Example                                                 |
| ------------------ | --------------------------------------------------- | ------------------------------------------------------- |
| Region (optional)  | The region of the log source                        | `us-east-1`                                             |
| Bucket             | The S3 bucket name                                  | `bucket_name`                                           |
| Bucket Region      | The region of the S3 bucket                         | `us-east-1`                                             |
| Prefix             | Folder prefix                                       | `dnslogs`                                               |
| IAM Role ARN       | The IAM role ARN used by Fusion to integrate to AWS | `arn:aws:iam::123456789012:role/NetographyRole`         |
| SQS URL (optional) | Only needed if SQS has been configured              | `https://sqs.us-east-1.amazonaws.com/123456789012/logq` |

### Step 1: Enable Cisco Umbrella DNS Log Export to S3 <a href="#step-1-enable-cisco-umbrella-dns-log-export-to-s3" id="step-1-enable-cisco-umbrella-dns-log-export-to-s3"></a>

1. Log in to the Cisco Umbrella Dashboard.
2. Navigate to Admin > Log Management.
3. Under Log Export Settings, select Amazon S3 as the log destination.
4. Configure the following:
   * Bucket Name: The S3 bucket where logs will be exported. If you already have a bucket used for other logs, you can reuse it.
   * Region: The AWS region of the S3 bucket.
   * Prefix: Specify a prefix to separate Cisco Umbrella logs from other logs (e.g., cisco-umbrella-logs).
5. Save the configuration and confirm that Cisco Umbrella is exporting logs to the bucket.

### Step 2: Add a Cisco Umbrella DNS Traffic Source in Fusion <a href="#step-2-add-a-cisco-umbrella-dns-traffic-source-in-fusion" id="step-2-add-a-cisco-umbrella-dns-traffic-source-in-fusion"></a>

1. In Fusion, Navigate to **Settings > Traffic Sources**
2. Click **ADD TRAFFIC SOURCE**
3. In the DNS section, click **Cisco Umbrella**
4. Complete the form with the information you collected in the previous step.

| Field            | Required | Description                                                                                | Examples                                                |
| ---------------- | -------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------- |
| Name             | yes      | Name of the traffic source                                                                 | my-query-logs                                           |
| S3 Bucket Name   | yes      | S3 bucket where Cisco Umbrella logs are stored                                             | umbrella-dns-logs                                       |
| S3 Bucket Region | yes      | AWS region of the S3 bucket                                                                | us-east-1                                               |
| Prefix           | no       | Folder prefix for Cisco Umbrella logs                                                      | cisco-umbrella-logs                                     |
| SQS URL          | no       | If provided, SQS will notify Netography that a new object was written for immediate ingest | <https://sqs.us-east-1.amazonaws.com/123456789012/logq> |

5. In the **Authentication** section, select **Role** for **AWS Authentication Type** and enter the ARN for the IAM role you are using to integrate Fusion to AWS.

{% hint style="info" %}
**📘Fusion role permissions required to add a new DNS traffic source**

To add a new DNS traffic source, the user's Role in Fusion must have the **Cloud Providers > Manage** permission. This setting is found in **Settings > Roles > Setup**.
{% endhint %}

### Optional AWS Configuration Step: Adding an SNS Topic and SQS Queue <a href="#optional-aws-configuration-step-adding-an-sns-topic-and-sqs-queue" id="optional-aws-configuration-step-adding-an-sns-topic-and-sqs-queue"></a>

{% hint style="info" %}
**❓Should I skip this step?**

Fusion will poll the configured S3 bucket for new logs every minute. However, if you add a SNS topic and SQS queue for a VPC you configured in the previous step, Fusion will receive a notification from AWS when a new log is available and immediately trigger reading that log. This means that DNS resolver logs will be ingested up to 59 seconds faster (\~30 seconds on average) if you complete this step. The cost of this added efficiency is the additional configuration required for this step (AWS usage charges for SQS/SNS for this purpose are less than 1 cent per log source per month).

You can safely skip this step and come back to it later if you decide it is important.
{% endhint %}

For each traffic source you configured for resolver query logging:

1. Create a SNS topic
2. Create a SQS queue
3. Subscribe the SQS queue to the SNS topic
4. Add event notifications (destined for the SQS queue) in the S3 bucket
5. Add the SQS queue ARN to IAM permission policy attached to the Fusion IAM role.

#### 1. Create a SNS Topic <a href="#id-1-create-a-sns-topic" id="id-1-create-a-sns-topic"></a>

1. Sign in to the Amazon SNS console at:\
   <https://console.aws.amazon.com/sns/home>
2. On the navigation panel, choose **Topics**.
3. On the Topics page, choose **Create topic**.
4. For Type, choose **Standard**.
5. Enter a Name for the topic (e.g. `fusion_umbrella-dns-logs_1234`).
6. Choose **Create topic**.
7. **Make a note of the topic ARN displayed.**

For additional details on creating a SNS topic, see AWS documentation:

<https://docs.aws.amazon.com/sns/latest/dg/sns-create-topic.html>

#### 2. Create a SQS queue <a href="#id-2-create-a-sqs-queue" id="id-2-create-a-sqs-queue"></a>

1. Open the Amazon SQS console at:\
   <https://console.aws.amazon.com/sqs/>
2. Choose **Create queue**.
3. For Type, use the default **Standard queue type**.
4. Enter a Name for your queue (e.g. `fusion_umbrella-dns-logs_1234`).
5. In the Configuration section, set the Message retention period to **1 day**.
6. In the Access Policy section, set the Method to **Advanced**, and paste the following JSON, updating the **aws:SourceArn** value from

   `"arn:aws:s3:::<bucketname>"` to the S3 bucket ARN you are using.

{% tabs %}
{% tab title="JSON" %}

````
```json
{
   "Version": "2012-10-17",
   "Id": "PushMessageToSQSPolicy",
   "Statement": [
      {
         "Sid": "allow-sns-to-send-message-to-sqs",
         "Effect": "Allow",
         "Principal": {
            "AWS": "*"
         },
         "Action": "sqs:SendMessage",
         "Resource": "*",
         "Condition": {
            "StringLike": {
               "aws:SourceArn": "arn:aws:s3:::<bucketname>"
            }
         }
      }
   ]
}
```

````

{% endtab %}
{% endtabs %}

7. Choose **Create queue**. Amazon SQS creates the queue and displays the queue's Details page.

For additional details on creating a SQS queue, see AWS documentation:

<https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/creating-sqs-standard-queues.html>

#### 3. Subscribe SQS Queue to SNS Topic <a href="#id-3-subscribe-sqs-queue-to-sns-topic" id="id-3-subscribe-sqs-queue-to-sns-topic"></a>

1. After creating the queue, you will see the queue's Details page. Under the SNS Subscriptions Tab, select the **Subscribe to Amazon SNS Topic** button.
2. Choose **Enter Amazon SNS topic ARN** and then enter the SNS topic ARN you noted in the previous step.
3. Choose **Save**.
4. **Make a note of your SQS URL and SQS ARN.**

#### 4. Add event notifications (destined for the SQS queue) in the S3 bucket <a href="#id-4-add-event-notifications-destined-for-the-sqs-queue-in-the-s3-bucket" id="id-4-add-event-notifications-destined-for-the-sqs-queue-in-the-s3-bucket"></a>

1. In the AWS console, navigate to **S3**, select your S3 bucket, and click the **Properties** tab.
2. In the **Event Notifications** section, click **Create event notification**.
3. Enter a name for the notification (e.g. `fusion_umbrella-dns-notification_1234`).
4. The **prefix** field needs to be set to the path to which the resolver logs for the VPC are being written. This is *NOT* the same prefix as you set when first configuring the DNS resolver query logs for the VPC (but it starts with that if you set it).

   If you set a prefix when configuring the DNS resolver query logs for the traffic source to `dnslogs`, this path will be: `dnslogs/`.

   If you did not set a prefix, this path will be: `/`.
5. In the **Event Types** section, check **All objects create events**.
6. In the **Destination** section, select **SQS Queue**.
7. Enter the **SQS Queue ARN**
8. Click **Save**.

#### 5. Add SQS ARN to IAM permission policy attached to the Fusion IAM role <a href="#id-5-add-sqs-arn-to-iam-permission-policy-attached-to-the-fusion-iam-role" id="id-5-add-sqs-arn-to-iam-permission-policy-attached-to-the-fusion-iam-role"></a>

To integrate with AWS, Fusion is configured with an IAM role with a permission policy attached. You must add each SQS ARN you created in the previous steps to the **Resource** section of this permission policy so that Fusion can receive notifications that new logs are available to ingest.

If you are creating multiple SQS queues, you can collect all the SQS ARN you created in the previous steps and add them to the permission policy in one final step.

{% hint style="info" %}
**📘Identifying the right IAM permission policy to update**

The IAM policy name is`NetographyPolicy`in Fusion's default CloudFormation, but if it was created with the AWS Console or a non-default name is used, you will need to find the right policy. If you have a small AWS deployment, searching for `Netography` or `Fusion` may be a quick way to find it.

If you do not know the policy name, you can identify it by:

1. In Fusion, navigate to **Settings > Traffic Sources**, click **…** next to any AWS flow source using this role, and select **Edit**. Make a note of the **AWS ARN** in the **Authentication** section of this page.

2. In the AWS Console, under **Services** go to **IAM**, select **Roles** from the menu, and then search for the last section of the ARN (e.g. if the ARN is `arn:aws:iam::1234567890:role/NetographyFusionRole`, search for `NetographyFusionRole`).

3. Select the role for the ARN to bring up the role details page. This page will contain the name of the permissions policy associated with this role. Select the permission policy.
   {% endhint %}

4. Sign in to the AWS Management Console and open the IAM console at:\
   <https://console.aws.amazon.com/iam/>

5. In the navigation pane, choose **Policies**.

6. In the list of policies, choose the policy name associated with the Netography Fusion IAM role (see the call-out above if you do not know what this is).

7. Choose the **Permissions tab**, and then choose **Edit**.

8. Choose the **JSON option** to modify your policy.

9. In the **Resource** section of the JSON, add the SQS ARNs that you created in the previous steps.

10. Choose **Save changes** to save your work, setting it as the new default policy version.

For additional details on updating the permission policy, see AWS documentation:

<https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html#edit-managed-policy-console>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/ingest-network-traffic-logs/dns-logs/cisco-umbrella-dns-logs-via-s3-setup-console.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.