{
    "id": "AWS",
    "title": "Amazon Web Services",
    "publisher": "Amazon",
    "descriptionMarkdown": "Follow these instructions to connect to AWS and stream your CloudTrail logs into Microsoft Sentinel. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "logo": "Aws.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "awsCloudTrail",
            "baseQuery": "AWSCloudTrail"
        }
    ],
    "sampleQueries": [
        {
            "description": "Summarize by name",
            "query": "AWSCloudTrail\n            | summarize count() by AWSRegion, TimeGenerated\n            | sort by TimeGenerated"
        },
        {
            "description": "Summarize by name",
            "query": "AWSCloudTrail\n            | summarize count() by EventName, TimeGenerated\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "SentinelKinds",
            "value": [
                "AmazonWebServicesCloudTrail"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "AWSCloudTrail",
            "lastDataReceivedQuery": "AWSCloudTrail\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false
       
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "write permission.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "delete": true
                }
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect AWS cloud trail with Microsoft Sentinel​",
            "description": "The connection necessitates giving Microsoft permissions to access your AWS account. To enable this, follow the instructions under [Connect AWS to Microsoft Sentinel](https://aka.ms/AWSConnector) and use these parameters when prompted:\n\n> Data from all regions will be sent to and stored in the workspace's region.\n\n> It takes about 5 minutes until the connection streams data to your workspace.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "MicrosoftAwsAccount"
                        ],
                        "label": "Microsoft account ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "External ID (Workspace ID)"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "text": "The integration is applicable for AWS public cloud accounts.",
                        "visible": false,
                        "inline": true
                    },
                    "type": "InfoMessage"
                },
                {
                    "parameters": {},
                    "type": "AwsCloudTrail"
                }
            ]
        }
    ]
}