AWS Network Firewall CCF

Solutions/Amazon Web Services NetworkFirewall/Data Connectors/AWSNetworkFirewallLogs_CCP/AWSNetworkFirewallLog_ConnectorDefinition.json

@@ -11,7 +11,7 @@
 			"logo": "amazon_web_services_Logo.svg",
 			"publisher": "Microsoft",
 			"descriptionMarkdown": "This data connector allows you to ingest AWS Network Firewall logs into Microsoft Sentinel for advanced threat detection and security monitoring. By leveraging Amazon S3 and Amazon SQS, the connector forwards network traffic logs, intrusion detection alerts, and firewall events to Microsoft Sentinel, enabling real-time analysis and correlation with other security data",
-			"graphQueriesTableName": "AWSNetworkFirewall_FlowLog_CL",
+			"graphQueriesTableName": "AWSNetworkFirewallFlow",
 			"graphQueries": [
 				{
 					"metricName": "Total Flow events received",
@@ -21,12 +21,12 @@
 				{
 					"metricName": "Total Alerts received",
 					"legend": "Amazon Web Services NetworkFirewall AlertLog",
-					"baseQuery": "AWSNetworkFirewall_AlertLog_CL"
+					"baseQuery": "AWSNetworkFirewallAlert"
 				},
 				{
-					"metricName": "Total Alerts received",
+					"metricName": "Total TLS logs received",
 					"legend": "Amazon Web Services NetworkFirewall TLSLog",
-					"baseQuery": "AWSNetworkFirewall_TlsLog_CL"
+					"baseQuery": "AWSNetworkFirewallTls"
 				}
 			],
 			"sampleQueries": [
@@ -36,11 +36,11 @@
 				},
 				{
 					"description": "Get Sample of Alert logs",
-					"query": "AWSNetworkFirewall_AlertLog_CL\n | take 10"
+					"query": "AWSNetworkFirewallAlert\n | take 10"
 				},
 				{
 					"description": "Get Sample of Tls logs",
-					"query": "AWSNetworkFirewall_TlsLog_CL\n | take 10"
+					"query": "AWSNetworkFirewallTls\n | take 10"
 				}
 			],
 			"dataTypes": [
@@ -49,12 +49,12 @@
 					"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
 				},
 				{
-					"name": "AWSNetworkFirewall_AlertLog_CL",
-					"lastDataReceivedQuery": "AWSNetworkFirewall_AlertLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+					"name": "AWSNetworkFirewallAlert",
+					"lastDataReceivedQuery": "AWSNetworkFirewallAlert\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
 				},
 				{
-					"name": "AWSNetworkFirewall_TlsLog_CL",
-					"lastDataReceivedQuery": "AWSNetworkFirewall_TlsLog_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+					"name": "AWSNetworkFirewallTls",
+					"lastDataReceivedQuery": "AWSNetworkFirewallTls\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
 				}
 			],
 			"connectivityCriteria": [
@@ -85,11 +85,33 @@
 			},
 			"instructionSteps": [
 				{
+					"title": "Ingesting AWS NetworkFirewall logs in Microsoft Sentinel",
+					"description": "### List of Resources Required:\n\n* Open ID Connect (OIDC) web identity provider\n* IAM Role\n* Amazon S3 Bucket\n* Amazon SQS\n* AWSNetworkFirewall configuration\n* Follow this instructions for [AWS NetworkFirewall Data connector](https://github.com/v-sreddyt/AWS_Networkfirewall/blob/main/readme.md) configuration \n\n",
 					"instructions": [
 						{
 							"type": "Markdown",
 							"parameters": {
-								"content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates need to be executed in AWS  \n You can find the OIDC Web Identity Provider, AWS Network Firewall Configuration Templates [Here](https://github.com/v-sreddyt/AWS_Networkfirewall/tree/main/CloudFormationTemplates) \n You can find the detailed steps for deploying the templates [Here](https://github.com/v-sreddyt/AWS_Networkfirewall/blob/main/readme.md)"
+								"content": "#### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an S3 bucket to your Log Analytics Workspace.\n #### For each template, create Stack in AWS: \n 1. Go to [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create). \n 2. Choose the ‘**Specify template**’ option, then ‘**Upload a template file**’ by clicking on ‘**Choose file**’ and selecting the appropriate CloudFormation template file provided below. click ‘**Choose file**’ and select the downloaded template. \n 3. Click '**Next**' and '**Create stack**'."
+							}
+						},
+						{
+							"type": "CopyableLabel",
+							"parameters": {
+								"label": "Template 1: OpenID connect authentication deployment",
+								"isMultiLine": true,
+								"fillWith": [
+									"Oidc"
+								]
+							}
+						},
+						{
+							"type": "CopyableLabel",
+							"parameters": {
+								"label": "Template 2: AWSNetworkFirewall resources deployment",
+								"isMultiLine": true,
+								"fillWith": [
+									"AWSNetworkFirewall"
+								]
 							}
 						},
 						{