> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-dns-logs.md).
# Configure DNS Logs
Prisma Cloud ingests the DNS logs from Amazon Kinesis Data Firehose and leverages those DNS query logs for DNS threat detection use cases, such as randomly generated domains (DGAs) and cryptomining. Prisma Cloud fetches the DNS query logs for an account that is streamed in Amazon Kinesis Data Firehose Stream in a logging account on AWS.
DNS log ingestion is not supported on Prisma Cloud stacks in AWS China and Gov Cloud.
1. After you [Onboard Your AWS Account](/content-collections/connect/connect-cloud-accounts/onboard-aws/onboard-aws-account.md), select **Settings > Providers > Cloud Accounts**.
2. Click the **View** icon next to the AWS account from which you want to ingest DNS logs Amazon Kinesis Data Firehose.
3. Click **Threat Detection**.
4. Toggle the **Disabled** button to **Enabled** for **DNS Logs**.
5. Click **Configure DNS Logs**.
6. Click **Add DNS Configuration**.
7. Enter a **Name** for your DNS Configuration.
8. Click **Generate**.
A Webhook token is generated. You can choose to specify Domain Filters.
9. Click **Next**.
10. Click the **Click here to create stack in your AWS management account** link to stream DNS query logs to Prisma Cloud.
1. Log in to your AWS account and follow the steps to create a stack, select **I acknowledge that AWS CloudFormation might create IAM resources with custom names**, and click **Create Stack**.
2. Wait for status to display CREATE\_COMPLETE.
On successful creation, WebhookUrl, BackupS3BucketARN, and KinesisFirehoseRoleARN parameters are generated. Copy and save the values in a text file.
3. Create **Route-53 query logging config** and **firehose pipeline** per region by using CloudFormation StackSet .
Running a stackset requires the following two roles. See the [AWS documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs-self-managed.html) to grant these self managed permissions:
* [AWS Cloud Formation StackSet Administration Role](https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetAdministrationRole.yml)
* [AWS Cloud Formation StackSet Execution Role](https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/AWSCloudFormationStackSetExecutionRole.yml)
4. After setting up the two roles, in your AWS console select **Settings > CloudFormation template > StackSets > Create StackSet**.
5. Choose a template for StackSet creation using [Amazon S3 URL](https://redlock-public.s3.amazonaws.com/cft/prisma-dnslogs.onboarding-cft-stack-part-2.template).
6. Enter the StackSet details, these are the parameters you obtained previously in Step 10.b above.
7. Set deployment options, such as account and regions for DNS query logging monitoring, and click **Next**.
* The account ID should match the one on which the first CFT was executed.
* Since you are using a logging account model for sending logs, make sure to apply both CFTs on the logging account and then share Route-53 query logging configuration with each account where you want to send DNS logs from.
* Sharing DNS Route-53 is ideal when you want to enable DNS ingestion for AWS organizations or Multiple accounts.
8. Review the configuration.
9. Click **Submit** for StackSet creation.
11. After the AWS configuration changes are complete, return to your Prisma Cloud console.
12. Select the **I acknowledge…** checkbox and click **Save**.
13. Click **Done**.
On successful configuration, Prisma Cloud starts to ingest DNS logs from Amazon Kinesis Data Firehose.
14. Once the stackset deployment is complete, in your AWS console select **Route 53 > Resolver > Query Logging**, click **Route-53 query logging config** created by the CFT, and select the VPCs whose DNS query logs you want Prisma Cloud to ingest.
Repeat step 14 for every region where the stackset is deployed.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/configure-dns-logs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.