Route 53 domain update / deletion alarm

Hi Lucas,

Update/Deletion of an AWS resource should be logged in Cloudtrail, so the LQL source is Cloudtrail:CloudTrailRawEvents.
Filter on the right elements in the Cloudtrail by looking at the description of the events with the CLI:
lacework query preview-source CloudTrailRawEvents.

Now, it looks to be that kind of action :
https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DeleteDomain.html

then, test your query in CLI (with the right filters):
 

--noninteractive      turn off interactive mode (disable spinners, prompts, etc.)
queryId: Example_DeleteDomain
queryText: |-
 {
     source {
         CloudTrailRawEvents
     }
     filter {
         EVENT_NAME =’DeleteDomain’
     }
     return distinct {
         INSERT_ID,
         INSERT_TIME,
         EVENT_TIME,
         EVENT
     }
 }