{
    "id": "AwsS3",
    "title": "Amazon Web Services S3",
    "publisher": "Amazon",
    "descriptionMarkdown": "This connector allows you to ingest AWS service logs, collected in AWS S3 buckets, to Microsoft Sentinel. The currently supported data types are: \n* AWS CloudTrail\n* VPC Flow Logs\n* AWS GuardDuty\n* AWS CloudWatch\n\nFor more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "logo": "Aws.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "AWSGuardDuty (MBytes)",
            "baseQuery": "AWSGuardDuty\n | extend Quantity = todecimal((estimate_data_size(*))) / 1024 / 1024",
            "nonAnalyticsTierBaseQuery": "Usage\n | where DataType == 'AWSGuardDuty'"
        },
        {
            "metricName": "Total data received",
            "legend": "AWSVPCFlow (MBytes)",
            "baseQuery": "AWSVPCFlow\n | extend Quantity = todecimal((estimate_data_size(*))) / 1024 / 1024",
            "nonAnalyticsTierBaseQuery": "Usage\n | where DataType == 'AWSVPCFlow'"
        },
        {
            "metricName": "Total data received",
            "legend": "AWSCloudTrail (MBytes)",
            "baseQuery": "AWSCloudTrail\n | extend Quantity = todecimal((estimate_data_size(*))) / 1024 / 1024",
            "nonAnalyticsTierBaseQuery": "Usage\n | where DataType == 'AWSCloudTrail'"
        },
        {
            "metricName": "Total data received",
            "legend": "AWSCloudWatch (MBytes)",
            "baseQuery": "AWSCloudWatch\n | extend Quantity = todecimal((estimate_data_size(*))) / 1024 / 1024",
            "nonAnalyticsTierBaseQuery": "Usage\n | where DataType == 'AWSCloudWatch'"
        }
    ],
    "sampleQueries": [
        {
            "description": "High severity findings summarized by activity type",
            "query": "AWSGuardDuty\n            | where Severity > 7\n            | summarize count() by ActivityType"
        },
        {
            "description": "Top 10 rejected actions of type IPv4",
            "query": "AWSVPCFlow\n            | where Action == \"REJECT\"\n            | where Type == \"IPv4\"\n            | take 10"
        },
        {
            "description": "User creation events summarized by region",
            "query": "AWSCloudTrail\n            | where EventName == \"CreateUser\"\n            | summarize count() by AWSRegion"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "AmazonWebServicesS3"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "AWSGuardDuty",
            "lastDataReceivedQuery": "AWSGuardDuty\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
            "nonAnalyticsTierLastDataReceivedQuery": "Usage\n | where DataType == 'AWSGuardDuty'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
            "name": "AWSVPCFlow",
            "lastDataReceivedQuery": "AWSVPCFlow\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
            "nonAnalyticsTierLastDataReceivedQuery": "Usage\n | where DataType == 'AWSVPCFlow'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
            "name": "AWSCloudTrail",
            "lastDataReceivedQuery": "AWSCloudTrail\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
            "nonAnalyticsTierLastDataReceivedQuery": "Usage\n | where DataType == 'AWSCloudTrail'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
            "name": "AWSCloudWatch",
            "lastDataReceivedQuery": "AWSCloudWatch\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)",
            "nonAnalyticsTierLastDataReceivedQuery": "Usage\n | where DataType == 'AWSCloudWatch'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "featureFlag": {
            "feature": "AWSS3Connector",
            "featureStates": {
                "Dogfood": "GA",
                "MPAC": "GA",
                "Prod": "GA",
                "Fairfax": "GA",
                "Mooncake": "PrivatePreview",
                "USSec": "PrivatePreview",
                "USNat": "PrivatePreview"
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ],
        "customs": [
            {
                "name": "Environment",
                "description": "you must have the following AWS resources defined and configured: S3, Simple Queue Service (SQS), IAM roles and permissions policies, and the AWS services whose logs you want to collect."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Set up your AWS environment",
            "description": "There are two options for setting up your AWS environment to send logs from an S3 bucket to your Log Analytics Workspace:",
            "instructions": [
                {
                    "parameters": {
                        "instructionSteps": [
                            {
                                "title": "Setup with PowerShell script (recommended)",
                                "instructions": [
                                    {
                                        "parameters": {
                                            "govScript": "Download and extract the files from the following link: [AWS S3 Setup Script](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScriptsGov.zip).\n\n> 1. Make sure that you have PowerShell on your machine: [Installation instructions for PowerShell](https://docs.microsoft.com/powershell/scripting/install/installing-powershell?view=powershell-7.2).\n\n> 2. Make sure that you have the AWS CLI on your machine: [Installation instructions for the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html).\n\nBefore running the script, run the aws configure command from your PowerShell command line, and enter the relevant information as prompted. See [AWS Command Line Interface | Configuration basics](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html) for details. Note: When Aws configure is run, Default output format should not be set to None. It must be set to some value, such as json.",
                                            "prodScript": "Download and extract the files from the following link: [AWS S3 Setup Script](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/AWS-S3/ConfigAwsS3DataConnectorScripts.zip).\n\n> 1. Make sure that you have PowerShell on your machine: [Installation instructions for PowerShell](https://docs.microsoft.com/powershell/scripting/install/installing-powershell?view=powershell-7.2).\n\n> 2. Make sure that you have the AWS CLI on your machine: [Installation instructions for the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html).\n\nBefore running the script, run the aws configure command from your PowerShell command line, and enter the relevant information as prompted. See [AWS Command Line Interface | Configuration basics](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html) for details. Note: When Aws configure is run, Default output format should not be set to None. It must be set to some value, such as json."
                                        },
                                        "type": "MarkdownControlEnvBased"
                                    },
                                    {
                                        "parameters": {
                                            "label": "Run script to set up the environment",
                                            "value": "./ConfigAwsConnector.ps1"
                                        },
                                        "type": "CopyableLabel"
                                    },
                                    {
                                        "parameters": {
                                            "fillWith": [
                                                "WorkspaceId"
                                            ],
                                            "label": "External ID (Workspace ID)"
                                        },
                                        "type": "CopyableLabel"
                                    }
                                ]
                            },
                            {
                                "title": "Manual Setup",
                                "description": "Follow the instruction in the following link to set up the environment: [Connect AWS S3 to Microsoft Sentinel](https://aka.ms/AWSS3Connector)"
                            }
                        ]
                    },
                    "type": "InstructionStepsGroup"
                }
            ]
        },
        {
            "title": "2. Add connection",
            "instructions": [
                {
                    "parameters": {},
                    "type": "AwsS3"
                }
            ]
        }
    ]
}