Add a new section on how to collect AWS Network Firewall using Firehose

[alaudazzi]

This PR:

• adds a new Firehose use case on Network Firewall logs.
• reuses content drafted in Figure out how to collect AWS Network Firewall using Amazon Data Firehose zmoog/public-notes#84.

Doc preview

Closes #3881

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}

[zmoog]

Here are a draft for the step four:

[discrete]
[[firehose-cloudtrail-step-four]]
== Step 4: Enable logging

The AWS Network Firewall logs has logging support built in. It supports sending logs to Amazon S3, Amazon CloudWatch, and Amazon Kinesis Data Firehose.

To enable logging to Amazon Data Firehose:

- In the AWS console, navigate to the AWS Network Firewall service.
- Select the firewall you want to enable logging for.
- In the *Logging* section, click *Edit*.
- Select the *Send logs to* option and choose *Kinesis Data Firehose*.
- Select the Firehose stream you created in the previous step.
- Click *Save*.

A note on the "Select the Send logs to option and choose Kinesis Data Firehose" step. Today, the AWS console still uses the old name "Kinesis Data Firehose" instead of the updated "Amazon Data Firehose".

So this is probably one of those cases where we need to abstract the guide away from the UI details.

[zmoog]

If you want to quickly check your Network Firewall logs before setting up Firehose, you can enable logging on CloudWatch, and then inspect the log events:

After rereading this part, I realized it isn't worth enabling logging on to CloudWatch. Enabling logging on CloudWatch brings value if we set up our test Network Firewall, and we want to double-check that our setup is sound and that it's actually logging data.

Since we assume the reader already has a working Network Firewall, I suggest setting up the logging to Firehose in step four.

[alaudazzi]

Thank you for your comments @zmoog. I'll be on PTO for the next two weeks, in case you need support you can reach out to @dedemorton (thank you DeDe!)

[mergify]

This pull request is now in conflict. Could you fix it @alaudazzi? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b network-firewall upstream/network-firewall
git merge upstream/main
git push upstream network-firewall

[alaudazzi]

@bmorelli25 @dedemorton
Thank you so much for your thorough review during my PTO -- appreciate it :-)

@zmoog
I integrated the comments and fixed a few minor things. If you are happy with the latest status of this doc, I'll go ahead and merge it.

[zmoog]

If you are happy with the latest status of this doc, I'll go ahead and merge it.

LGTM!

I'll open a different PR to link to the Terraform files.

[mdbirnstiehl]

🚀