Vendors / Amazon Web Services / Route 53 Resolver / Route 53 Resolver successful A query

Event type

Route 53 Resolver successful A query

Successful UDP IN/A Resolver query with one IPv4 answer; registry-backed EC2/VPC identity and DNS answer, Faker source port, fresh UTC time.

JSON 18 fields Generator

aws dns route53

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

Documented JSON wire profile 1.100000, direct VPC query, no firewall match. Requires source-specific entities: entities/aws/route53-resolver/dns-query.yaml; example configuration: configs/aws/route53-resolver/dns-query.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›An EC2 client makes a successful UDP A query.

Security relevance

Informational

Frequency notes

Independent sample queries; one event/second test rate, not Resolver cache or delivery simulation.

Resources

Docs and tools

Wire field names and value representations official Query, answer and conditional firewall-field definitions official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

version

String Optional

Fixed `1.100000`, exact wire example.

Source: Fixed `1.100000`, exact wire example.

Example 1.100000

account_id

String Optional

Selected device `aws_account_id`, twelve digits; stable account of its VPC, leading zeros retained.

Source: Selected device `aws_account_id`, twelve digits; stable account of its VPC, leading zeros retained.

Example 111122223333

region

String Optional

Fixed `us-east-1`; fixture resources belong to this region.

Source: Fixed `us-east-1`; fixture resources belong to this region.

Example us-east-1

vpc_id

String Optional

Same device `aws_vpc_id`; local modern `vpc-` plus 17 lowercase hex subset.

Source: Same device `aws_vpc_id`; local modern `vpc-` plus 17 lowercase hex subset.

Example vpc-0123456789abcdef0

query_timestamp

String Optional

One `now()` through `iso8601_utc`; UTC ISO8601 with microseconds and Z.

Source: One `now()` through `iso8601_utc`; UTC ISO8601 with microseconds and Z.

Example 2026-10-01T22:47:44.694138Z

query_name

String Optional

Mapped service `dns_name`; local lowercase alphabetic label under example.com, trailing dot.

Source: Mapped service `dns_name`; local lowercase alphabetic label under example.com, trailing dot.

Example files.example.com.

query_type

String Optional

Fixed `A` / `IN` / `NOERROR`.

Source: Fixed `A` / `IN` / `NOERROR`.

Example A

query_class

String Optional

Fixed `A` / `IN` / `NOERROR`.

Source: Fixed `A` / `IN` / `NOERROR`.

Example IN

rcode

String Optional

Fixed `A` / `IN` / `NOERROR`.

Source: Fixed `A` / `IN` / `NOERROR`.

Example NOERROR

answers

Array Optional

Exactly one answer object; case-sensitive keys below.

Source: Exactly one answer object; case-sensitive keys below.

Example [{"Class":"IN","Rdata":"198.51.100.11","Type":"A"}]

answers[0].Rdata

String Optional

Same service `dns_answer_ipv4`; stable for this query name.

Source: Same service `dns_answer_ipv4`; stable for this query name.

Example 198.51.100.11

answers[0].Type

String Optional

DNS answer type. Fixed A, matching the IPv4 answer and query.

Source: Fixed A.

Example A

srcaddr

String Optional

Selected device `ip_address`.

Source: Selected device `ip_address`.

Example 10.20.0.11

srcport

String Optional

`fake.pyint(min_value=49152, max_value=65535)` then Jinja `string`; local client-port subset of 1–65535.

Source: `fake.pyint(min_value=49152, max_value=65535)` then Jinja `string`; local client-port subset of 1–65535.

Example 65271

transport

String Optional

Fixed `UDP`.

Source: Fixed `UDP`.

Example UDP

srcids

Object Optional

Exactly the instance key below for this source path.

Source: Exactly the instance key below for this source path.

Example {"instance":"i-8e59995608f14e0e7"}

srcids.instance

String Optional

Same device `aws_instance_id`; local `i-` plus 17 lowercase hex subset.

Source: Same device `aws_instance_id`; local `i-` plus 17 lowercase hex subset.

Example i-8e59995608f14e0e7

answers[0].Class

String Optional

DNS answer class. Fixed IN, matching the query class.

Source: Fixed IN.

Example IN