VPC Flow Logs

VPC Flow Logs capture metadata about IP traffic flowing through network interfaces in an AWS VPC, Azure VNet, or GCP VPC, recording source and destination IPs, ports, protocol, bytes transferred, and accept/reject decisions. Security teams analyze flow logs to detect unusual traffic patterns, identify lateral movement between subnets, and investigate data exfiltration.

Flow logs are a critical data source for network-based threat detection and are often streamed to SIEM platforms for correlation with other log sources.