{
  "name": "AWSS3VPCFlowLogsParquetDefinition",
  "apiVersion": "2024-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AWSS3VPCFlowLogsParquetDefinition",
      "title": "Amazon Web Services S3 VPC Flow Logs",
      "logo": "amazon_web_services_Logo.svg",
      "publisher": "Microsoft",
      "descriptionMarkdown": "This connector allows you to ingest AWS VPC Flow Logs, collected in AWS S3 buckets, to Microsoft Sentinel. AWS VPC Flow Logs provide visibility into network traffic within your AWS Virtual Private Cloud (VPC), enabling security analysis and network monitoring.",
      "graphQueriesTableName": "AWSVPCFlow",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "AWS VPC Flow Logs Parquet",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | where TimeGenerated > ago(12h) | where name_s == \"no data test\"               | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
            {
              "instructions": [
                {
                  "type": "Markdown",
                  "parameters": {
                    "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates have been generated to set up the AWS environment to send VPC Flow Logs from an S3 bucket to your Log Analytics Workspace.\n #### For each template, create a Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create). \n 2. Choose the ‘Specify template’ option, then ‘Upload a template file’ by clicking on ‘Choose file’ and selecting the appropriate CloudFormation template file provided below. Click ‘Choose file’ and select the downloaded template. \n 3. Click 'Next' and 'Create stack'."
                  }
                },
                {
                  "type": "CopyableLabel",
                  "parameters": {
                    "label": "Template 1: OpenID connect authentication deployment",
                    "isMultiLine": true,
                    "fillWith": [
                      "Oidc"
                    ]
                  }
                },
                {
                  "type": "CopyableLabel",
                  "parameters": {
                    "label": "Template 2: AWS VPC Flow Logs resources deployment",
                    "isMultiLine": true,
                    "fillWith": [
                      "AwsVPCFlow"
                    ]
                  }
                },
                {
                  "type": "Markdown",
                  "parameters": {
                    "content": "#### 2. Connect new collectors \n To enable AWS S3 for Microsoft Sentinel, click the 'Add new collector' button, fill in the required information and click on 'Connect'"
                  }
                },
                {
                  "type": "DataConnectorsGrid",
                  "parameters": {
                    "mapping": [
                      {
                        "columnValue": "properties.roleArn",
                        "columnName": "Role ARN"
                      },
                      {
                        "columnValue": "properties.sqsUrls[0]",
                        "columnName": "Queue URL"
                      },
                      {
                        "columnValue": "properties.fileFormat",
                        "columnName": "File Format"
                      }
                    ],
                    "menuItems": [
                      "DeleteConnector"
                    ]
                  }
                },
                {
                  "type": "ContextPane",
                  "parameters": {
                    "contextPaneType": "DataConnectorsContextPane",
                    "title": "Add new controller",
                    "subtitle": "AWS VPC Flow Logs connector",
                    "label": "Add new collector",
                    "instructionSteps": [
                      {
                        "title": "Account details",
                        "instructions": [
                          {
                            "type": "Textbox",
                            "parameters": {
                              "label": "Role ARN",
                              "type": "text",
                              "name": "roleArn",
                              "validations": {
                                "required": true
                              }
                            }
                          },
                          {
                            "type": "Textbox",
                            "parameters": {
                              "label": "Queue URL",
                              "type": "text",
                              "name": "queueUrl",
                              "validations": {
                                "required": true
                              }
                            }
                          },
                          {
                            "type": "Dropdown",
                            "parameters": {
                              "label": "Data type",
                              "type": "text",
                              "name": "fileFormat",
                              "required": true,
                              "placeholder": "Select a file format",
                              "options": [
                                {
                                  "key": "Json",
                                  "text": "JSON Format"
                                },
                                {
                                  "key": "Parquet",
                                  "text": "Parquet Format"
                                },
                                {
                                  "key": "Csv",
                                  "text": "CSV Format"
                                }
                              ]
                            }
                          }
                        ]
                      }
                    ]
                  }
                }
              ]
            }
          ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}