Skip to content

Commit 4aebb0f

Browse files
author
Mateo Ruiz
committed
Merge branch 'mateoruiz/bugfix/multistream' of https://github.com/m-ruiz21/Azure-Sentinel into mateoruiz/bugfix/multistream
2 parents 99b3040 + fee7ffd commit 4aebb0f

File tree

8 files changed

+1717
-1305
lines changed

8 files changed

+1717
-1305
lines changed

‎Solutions/Amazon Web Services NetworkFirewall/Data/Solution_AmazonWebServices.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"Data Connectors/AWSNetworkFirewallLogs_CCP/AWSNetworkFirewallLog_ConnectorDefinition.json"
88
],
99
"BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Amazon Web Services NetworkFirewall",
10-
"Version": "3.0.0",
10+
"Version": "3.0.3",
1111
"Metadata": "SolutionMetadata.json",
1212
"TemplateSpec": true,
1313
"StaticDataConnectorIds": [

‎Solutions/Amazon Web Services NetworkFirewall/Package/3.0.3.zip‎

7.66 KB
Binary file not shown.

‎Solutions/Amazon Web Services NetworkFirewall/Package/createUiDefinition.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
"name": "dataconnectors1-text",
6161
"type": "Microsoft.Common.TextBlock",
6262
"options": {
63-
"text": "This Solution installs the data connector for Amazon Web Services NetworkFirewall. You can get Amazon Web Services NetworkFirewall data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
63+
"text": "This Solution installs the data connector for Amazon Web Services NetworkFirewall (via Codeless Connector Framework). You can get Amazon Web Services NetworkFirewall (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
6464
}
6565
},
6666
{

‎Solutions/Amazon Web Services NetworkFirewall/Package/mainTemplate.json‎

Lines changed: 3 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
},
4646
"variables": {
4747
"_solutionName": "Amazon Web Services NetworkFirewall",
48-
"_solutionVersion": "3.0.2",
48+
"_solutionVersion": "3.0.3",
4949
"solutionId": "azuresentinel.azure-sentinel-solution-aws-networkfirewall",
5050
"_solutionId": "[variables('solutionId')]",
5151
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
@@ -785,67 +785,7 @@
785785
"kind": "AmazonWebServicesS3",
786786
"properties": {
787787
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
788-
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
789-
"dataTypes": {
790-
"logs": {
791-
"state": "enabled"
792-
}
793-
},
794-
"dcrConfig": {
795-
"streamName": "[[parameters('streamName')[0]]",
796-
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
797-
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
798-
},
799-
"dataFormat": {
800-
"Format": "Json",
801-
"IsCompressed": true,
802-
"compressType": "Gzip"
803-
},
804-
"roleArn": "[[parameters('roleArn')]",
805-
"sqsUrls": [
806-
"[[parameters('queueUrl')]"
807-
]
808-
}
809-
},
810-
{
811-
"name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'AwsNetworkFirewall Flow Logs', parameters('guidValue'))]",
812-
"apiVersion": "2023-02-01-preview",
813-
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
814-
"location": "[parameters('workspace-location')]",
815-
"kind": "AmazonWebServicesS3",
816-
"properties": {
817-
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
818-
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
819-
"dataTypes": {
820-
"logs": {
821-
"state": "enabled"
822-
}
823-
},
824-
"dcrConfig": {
825-
"streamName": "[[parameters('streamName')[0]]",
826-
"dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
827-
"dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
828-
},
829-
"dataFormat": {
830-
"Format": "Json",
831-
"IsCompressed": true,
832-
"compressType": "Gzip"
833-
},
834-
"roleArn": "[[parameters('roleArn')]",
835-
"sqsUrls": [
836-
"[[parameters('queueUrl')]"
837-
]
838-
}
839-
},
840-
{
841-
"name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'AwsNetworkFirewall Tls Logs', parameters('guidValue'))]",
842-
"apiVersion": "2023-02-01-preview",
843-
"type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
844-
"location": "[parameters('workspace-location')]",
845-
"kind": "AmazonWebServicesS3",
846-
"properties": {
847-
"connectorDefinitionName": "AwsNetworkFirewallCcpDefinition",
848-
"destinationTable": "[[concat(parameters('streamName')[0],'_CL')]",
788+
"destinationTable": "[[if(equals(parameters('streamName')[0], 'Custom-AWSNetworkFirewall-AlertLog'), 'AWSNetworkFirewallAlert', if(equals(parameters('streamName')[0], 'Custom-AWSNetworkFirewall-FlowLog'), 'AWSNetworkFirewallFlow', 'AWSNetworkFirewallTls'))]]",
849789
"dataTypes": {
850790
"logs": {
851791
"state": "enabled"
@@ -883,7 +823,7 @@
883823
"apiVersion": "2023-04-01-preview",
884824
"location": "[parameters('workspace-location')]",
885825
"properties": {
886-
"version": "3.0.2",
826+
"version": "3.0.3",
887827
"kind": "Solution",
888828
"contentSchemaVersion": "3.0.0",
889829
"displayName": "Amazon Web Services NetworkFirewall",

‎Solutions/Amazon Web Services NetworkFirewall/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
**Version** | **Date Modified (DD-MM-YYYY)**| **ChangeHistory** |
22
|------------|-------------------------------|-------------------------------------------------------------------------------------------|
3+
| 3.0.3 | 03-02-2026 | Fix duplicate collectors creation. |
34
| 3.0.2 | 19-08-2025 | **CCF Connector** moving to GA. |
45
| 3.0.1 | 23-07-2025 | Updated AWS Network Firewall Readme file and the associated links for the **CCF Data Connector** |
56
| 3.0.0 | 20-03-2025 | Initial Solution Release |

‎Tools/Create-Azure-Sentinel-Solution/common/createCCPConnector.ps1‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -757,8 +757,21 @@ function createCCPConnectorResources($contentResourceDetails, $dataFileMetadata,
757757
}
758758

759759
if ($fileContent -is [System.Object[]]) {
760-
foreach ($content in $fileContent) {
761-
CCPDataConnectorsResource -fileContent $content;
760+
if ($ccpItem.isDynamicStreamName) {
761+
# For dynamic streamName, only create ONE resource with conditional logic
762+
# Store all streamName->destinationTable mappings first
763+
$script:streamNameMappings = @{}
764+
foreach ($content in $fileContent) {
765+
if ($content.properties.dcrConfig.streamName -and $content.properties.destinationTable) {
766+
$script:streamNameMappings[$content.properties.dcrConfig.streamName] = $content.properties.destinationTable
767+
}
768+
}
769+
# Process only the first item, it will be parameterized
770+
CCPDataConnectorsResource -fileContent $fileContent[0];
771+
} else {
772+
foreach ($content in $fileContent) {
773+
CCPDataConnectorsResource -fileContent $content;
774+
}
762775
}
763776
}
764777
else {
@@ -1430,7 +1443,33 @@ function CreateAwsResourceProperties($armResource, $templateContentConnections,
14301443
if ($isDynamicStreamName) {
14311444
# Handle properties destinationTable and streamName in dc poller file for this solutions as a special case
14321445
$armResource.properties.dcrConfig.streamName = "[[parameters('streamName')[0]]"
1433-
$armResource.properties.destinationTable = "[[concat(parameters('streamName')[0],'_CL')]"
1446+
1447+
# Build conditional logic for destinationTable based on streamNameMappings
1448+
if ($script:streamNameMappings -and $script:streamNameMappings.Count -gt 0) {
1449+
$sortedMappings = $script:streamNameMappings.GetEnumerator() | Sort-Object Name
1450+
$conditionalLogic = ""
1451+
$mappingArray = @($sortedMappings)
1452+
1453+
# Build nested if() statements from right to left
1454+
for ($i = $mappingArray.Count - 1; $i -ge 0; $i--) {
1455+
$streamName = $mappingArray[$i].Key
1456+
$destTable = $mappingArray[$i].Value
1457+
1458+
if ($i -eq $mappingArray.Count - 1) {
1459+
# Last item (rightmost in the conditional)
1460+
$conditionalLogic = "'$destTable'"
1461+
} else {
1462+
# Wrap with if(equals())
1463+
$conditionalLogic = "if(equals(parameters('streamName')[0], '$streamName'), '$destTable', $conditionalLogic)"
1464+
}
1465+
}
1466+
1467+
$armResource.properties.destinationTable = "[[$conditionalLogic]]"
1468+
} else {
1469+
# Fallback to _CL suffix if no mappings found
1470+
$armResource.properties.destinationTable = "[[concat(parameters('streamName')[0],'_CL')]"
1471+
}
1472+
14341473
$templateContentConnections.properties.mainTemplate.parameters | Add-Member -NotePropertyName "streamName" -NotePropertyValue ([PSCustomObject] @{ type = "array" })
14351474
}
14361475
else {

0 commit comments

Comments
 (0)