Amazon AWS S3 REST API data source parameters for Amazon AWS Network Firewall

If the QRadar® product does not automatically detect the data source, add an Amazon AWS Network Firewall data source in the QRadar product by using the Amazon AWS REST API connector.

When using the Amazon AWS S3 REST API connector, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect Amazon AWS S3 REST API events from Amazon AWS Network Firewall:

Table 1. Amazon AWS S3 REST API ldata source parameters for the Amazon AWS Network Firewall DSM
Parameter	Value
Data source type	Amazon AWS Network Firewall
Connector type	Amazon AWS S3 REST API
Data Source Identifier	Type a unique name for the data source. The Data source identifier can be any valid value and does not need to reference a speciﬁc server. The Data source identifier can be the same as the data source name. If you have more than one Amazon AWS Network Firewall data source that is conﬁgured, you might want to identify the ﬁrst data source as `awsnetworkfirewall1`, the second data source as `awsnetworkfirewall2`, and the third data source as `awsnetworkfirewall3`.
Event Format	If you have a QRadar Flow Processor available and licensed to receive flow logs, select AWS Network Firewall. If you do not have a QRadar Flow Processor available and licensed to receive flow logs, select LINEBYLINE.

For a complete list of Amazon AWS S3 REST API connector parameters and their values, see Amazon AWS S3 REST API connector configuration options.