Amazon AWS S3 REST API data source parameters for Amazon AWS Network Firewall
If the QRadar® product does not automatically detect the data source, add an Amazon AWS Network Firewall data source in the QRadar product by using the Amazon AWS REST API connector.
When using the Amazon AWS S3 REST API connector, there are specific parameters that you must use.
|Data source type||Amazon AWS Network Firewall|
|Connector type||Amazon AWS S3 REST API|
|Data Source Identifier||
Type a unique name for the data source.
The Data source identifier can be any valid value and does not need to reference a speciﬁc server. The Data source identifier can be the same as the data source name. If you have more than one Amazon AWS Network Firewall data source that is conﬁgured, you might want to identify the ﬁrst data source as awsnetworkfirewall1, the second data source as awsnetworkfirewall2, and the third data source as awsnetworkfirewall3.
If you have a QRadar Flow Processor available and licensed to receive flow logs, select AWS Network Firewall.
If you do not have a QRadar Flow Processor available and licensed to receive flow logs, select LINEBYLINE.
For a complete list of Amazon AWS S3 REST API connector parameters and their values, see Amazon AWS S3 REST API connector configuration options.