↳ GitHub sourceConnector
Amazon Web Services NetworkFirewall (via Codeless Connector Framework)
Description
This data connector allows you to ingest AWS Network Firewall logs into Microsoft Sentinel for advanced threat detection and security monitoring. By leveraging Amazon S3 and Amazon SQS, the connector forwards network traffic logs, intrusion detection alerts, and firewall events to Microsoft Sentinel, enabling real-time analysis and correlation with other security data
- Declared status
- 1
- Declared author / publisher
- Microsoft
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
Read and Write permissions are required.
Workspace
Workspace
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Ingesting AWS NetworkFirewall logs in Microsoft Sentinel
### List of Resources Required:
* Open ID Connect (OIDC) web identity provider
* IAM Role
* Amazon S3 Bucket
* Amazon SQS
* AWSNetworkFirewall configuration
* Follow this instructions for [AWS NetworkFirewall Data connector](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services%20NetworkFirewall/Data%20Connectors/readme.md) configuration
Template 1: OpenID connect authentication deployment
Template 2: AWSNetworkFirewall resources deployment
Add new controller
Add new collector
Account details
Role ARN
Queue URL
Data type
Alert Log
Flow Log
Tls Log
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
AwsNetworkFirewallCcpDefinition
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC