{
  "name": "AwsSecurityHubFindingsCcpDefinition",
  "apiVersion": "2024-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AwsSecurityHubFindingsCcpDefinition",
      "title": "AWS Security Hub Findings (via Codeless Connector Framework)",
      "logo": "amazon_web_services_Logo.svg",
      "publisher": "Microsoft",
      "descriptionMarkdown": "This connector enables the ingestion of AWS Security Hub Findings, which are collected in AWS S3 buckets, into Microsoft Sentinel. It helps streamline the process of monitoring and managing security alerts by integrating AWS Security Hub Findings with Microsoft Sentinel's advanced threat detection and response capabilities.",
      "graphQueriesTableName": "AWSSecurityHubFindings",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "AWS Security Hub Findings",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": false,
              "write": false,
              "delete": false,
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "Environment",
            "description": "You must have the following AWS resources defined and configured: AWS Security Hub, Amazon Data Firehose, Amazon EventBridge, S3 Bucket, Simple Queue Service (SQS), IAM roles and permissions policies."
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "### 1. AWS CloudFormation Deployment \n Use the provided CloudFormation templates to configure the AWS environment for sending logs from AWS Security Hub to your Log Analytics Workspace.\n"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### Deploy CloudFormation Templates in AWS: \n1. Navigate to the [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create).\n2. Click **Create stack** and select **With new resources**.\n3. Choose **Upload a template file**, then click **Choose file** to upload the appropriate CloudFormation template provided.\n4. Follow the prompts and click **Next** to complete the stack creation.\n5. After the stacks are created, note down the **Role ARN** and **SQS Queue URL**.\n"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 1: OpenID Connect authentication provider deployment",
                "isMultiLine": true,
                "fillWith": [
                  "Oidc"
                ]
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 2: AWS Security Hub resources deployment",
                "isMultiLine": true,
                "fillWith": [
                  "AwsSecurityHub"
                ]
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "### 2. Connect new collectors \n To enable AWS Security Hub Connector for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnValue": "properties.roleArn",
                    "columnName": "Role ARN"
                  },
                  {
                    "columnValue": "properties.sqsUrls[0]",
                    "columnName": "Queue URL"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "contextPaneType": "DataConnectorsContextPane",
                "title": "Add new controller",
                "subtitle": "AWS Security Hub connector",
                "label": "Add new collector",
                "instructionSteps": [
                  {
                    "title": "Account details",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Role ARN",
                          "type": "text",
                          "name": "roleArn",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Queue URL",
                          "type": "text",
                          "name": "queueUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}