{
  "name": "AwsCloudfrontCcpDefinition",
  "apiVersion": "2022-09-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AwsCloudfrontCcpDefinition",
      "title": "Amazon Web Services CloudFront (via Codeless Connector Framework) (Preview)",
      "logo": "amazon_web_services_Logo.svg",
      "publisher": "Microsoft",
      "descriptionMarkdown": "This data connector enables the integration of AWS CloudFront logs with Microsoft Sentinel to support advanced threat detection, investigation, and security monitoring. By utilizing Amazon S3 for log storage and Amazon SQS for message queuing, the connector reliably ingests CloudFront access logs into Microsoft Sentinel",
      "graphQueriesTableName": "AWSCloudFront_AccessLog_CL",
      "graphQueries": [
        {
          "metricName": "Total access logs received",
          "legend": "Amazon Web Services CloudFront AccessLog",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of access logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Ingesting AWS CloudFront logs in Microsoft Sentinel",
          "description": "### List of Resources Required:\n\n* Open ID Connect (OIDC) web identity provider\n* IAM Role\n* Amazon S3 Bucket\n* Amazon SQS\n* AWS CloudFront configuration\n\n",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create). \n 2. Choose the \u2018**Specify template**\u2019 option, then \u2018**Upload a template file**\u2019 by clicking on \u2018**Choose file**\u2019 and selecting the appropriate CloudFormation template file provided below. click \u2018**Choose file**\u2019 and select the downloaded template. \n 3. Click '**Next**' and '**Create stack**'."
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 1: OpenID connect authentication deployment",
                "isMultiLine": true,
                "fillWith": [
                  "Oidc"
                ]
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 2: AWSCloudFront resources deployment",
                "isMultiLine": true,
                "fillWith": [
                  "AWSCloudFront"
                ]
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### 2. Connect new collectors \n To enable AWS S3 for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnValue": "properties.roleArn",
                    "columnName": "Role ARN"
                  },
                  {
                    "columnValue": "properties.sqsUrls[0]",
                    "columnName": "Queue URL"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "contextPaneType": "DataConnectorsContextPane",
                "title": "Add new controller",
                "subtitle": "AWS S3 connector",
                "label": "Add new collector",
                "instructionSteps": [
                  {
                    "title": "Account details",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Role ARN",
                          "type": "text",
                          "name": "roleArn",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Queue URL",
                          "type": "text",
                          "name": "queueUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}