Skip to content

DNS and firewall AI discovery

DNS resolver and firewall logs help Venturi detect direct AI-provider traffic that does not pass through an instrumented gateway.

Release state

This guide documents the read-only dns_firewall_log_analysis connector implemented in the platform connector surface.

Required access

The names below are Venturi source-adapter capabilities, not vendor scopes:

Venturi capability Purpose
dns.query_logs.readonly Read resolver query logs.
firewall.connection_logs.readonly Read firewall egress logs.

Do not grant policy-write, blocking, allow-list, or firewall-rule mutation permissions.

Supported sources are customer-selected DNS resolver and firewall log exports, including Amazon Route 53 Resolver query logs, Cloudflare Gateway DNS logs, and Palo Alto Networks traffic logs. Configure the literal read-only authorization for the selected source; the Venturi capability names above are not pasted into the vendor console. See the official setup references for Route 53 Resolver query logging, Cloudflare Gateway logs, and Palo Alto Networks traffic logs.

Setup

  1. Select DNS and firewall sources with AI-provider egress visibility.
  2. Create read-only log credentials for those sources.
  3. Store credential references in Venturi.
  4. Set VENTURI_DNS_FIREWALL_LOOKBACK_HOURS if the default 24-hour poll window is not appropriate.
  5. In Venturi, open Integrations and select DNS/firewall log analysis and run Test connection.

Verification

  • The connector reports ready sources for each reachable log source.
  • Provider-domain matches appear as detected-only observations.
  • Provider domain/IP matches are labeled as discovery evidence, not request attribution.
  • The connector does not mutate DNS or firewall policy.
  • The read-only inventory test confirms the credential cannot change DNS or firewall policy.

Venturi maintains a versioned provider-domain and published-IP registry. Updates are reviewed, dated, and deployed with the connector package. DNS and ordinary firewall logs do not expose URL paths without TLS inspection, which this connector does not perform.

Rotation and offboarding

Rotate log-reader credentials through the relevant DNS or firewall system. Removing the connector stops new detected-only observations from those logs.