{
  "name": "AwsNetworkFirewallCcpDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AwsNetworkFirewallCcpDefinition",
      "title": "Amazon Web Services NetworkFirewall (via Codeless Connector Framework)",
      "logo": "amazon_web_services_Logo.svg",
      "publisher": "Microsoft",
      "descriptionMarkdown": "This data connector allows you to ingest AWS Network Firewall logs into Microsoft Sentinel for advanced threat detection and security monitoring. By leveraging Amazon S3 and Amazon SQS, the connector forwards network traffic logs, intrusion detection alerts, and firewall events to Microsoft Sentinel, enabling real-time analysis and correlation with other security data",
      "graphQueriesTableName": "AWSNetworkFirewallFlow",
      "graphQueries": [
        {
          "metricName": "Total Flow events received",
          "legend": "Amazon Web Services NetworkFirewall FlowLog",
          "baseQuery": "{{graphQueriesTableName}}"
        },
        {
          "metricName": "Total Alerts received",
          "legend": "Amazon Web Services NetworkFirewall AlertLog",
          "baseQuery": "AWSNetworkFirewallAlert"
        },
        {
          "metricName": "Total TLS logs received",
          "legend": "Amazon Web Services NetworkFirewall TLSLog",
          "baseQuery": "AWSNetworkFirewallTls"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of Flow logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        },
        {
          "description": "Get Sample of Alert logs",
          "query": "AWSNetworkFirewallAlert\n | take 10"
        },
        {
          "description": "Get Sample of Tls logs",
          "query": "AWSNetworkFirewallTls\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "AWSNetworkFirewallAlert",
          "lastDataReceivedQuery": "AWSNetworkFirewallAlert\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        },
        {
          "name": "AWSNetworkFirewallTls",
          "lastDataReceivedQuery": "AWSNetworkFirewallTls\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Ingesting AWS NetworkFirewall logs in Microsoft Sentinel",
          "description": "### List of Resources Required:\n\n* Open ID Connect (OIDC) web identity provider\n* IAM Role\n* Amazon S3 Bucket\n* Amazon SQS\n* AWSNetworkFirewall configuration\n* Follow this instructions for [AWS NetworkFirewall Data connector](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services%20NetworkFirewall/Data%20Connectors/readme.md) configuration \n\n",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create). \n 2. Choose the \u2018**Specify template**\u2019 option, then \u2018**Upload a template file**\u2019 by clicking on \u2018**Choose file**\u2019 and selecting the appropriate CloudFormation template file provided below. click \u2018**Choose file**\u2019 and select the downloaded template. \n 3. Click '**Next**' and '**Create stack**'."
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 1: OpenID connect authentication deployment",
                "isMultiLine": true,
                "fillWith": [
                  "Oidc"
                ]
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 2: AWSNetworkFirewall resources deployment",
                "isMultiLine": true,
                "fillWith": [
                  "AWSNetworkFirewall"
                ]
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Connect new collectors \n To enable AWS S3 for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnValue": "properties.roleArn",
                    "columnName": "Role ARN"
                  },
                  {
                    "columnValue": "properties.sqsUrls[0]",
                    "columnName": "Queue URL"
                  },
                  {
                    "columnValue": "properties.dcrConfig.streamName",
                    "columnName": "Stream name"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "contextPaneType": "DataConnectorsContextPane",
                "title": "Add new controller",
                "subtitle": "AWS S3 connector",
                "label": "Add new collector",
                "instructionSteps": [
                  {
                    "title": "Account details",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Role ARN",
                          "type": "text",
                          "name": "roleArn",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Queue URL",
                          "type": "text",
                          "name": "queueUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data type",
                          "type": "text",
                          "name": "streamName",
                          "required": true,
                          "placeholder": "Select a data type",
                          "options": [
                            {
                              "key": "Custom-AWSNetworkFirewall-AlertLog",
                              "text": "Alert Log"
                            },
                            {
                              "key": "Custom-AWSNetworkFirewall-FlowLog",
                              "text": "Flow Log"
                            },
                            {
                              "key": "Custom-AWSNetworkFirewall-TlsLog",
                              "text": "Tls Log"
                            }
                          ]
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}