Premium Hands-on labintermediateblue teamAWS
Detect Suspicious Network Traffic with VPC Flow Logs
Enable VPC Flow Logs and send them to Amazon CloudWatch Logs to capture real network traffic inside your VPC. You will explore the structure of flow log records, identify accepted and rejected connections, and use CloudWatch Logs Insights to run queries that surface suspicious or high-volume rejected traffic. By the end of this lab, you will understand how VPC Flow Logs help with network troubleshooting, threat detection, and security investigations in real-world AWS environments.
- 10 guided tasks
Scenario
To learn about VPC Flow logs, let's enable this feature so that we can see exactly how it works.
A VPC has already been created for you in this lab, so you can skip straight to enabling flow logs.
What you will learn
- Enable VPC Flow Logs on a VPC and send the records to CloudWatch Logs.
- Create a CloudWatch log group and set how long it keeps the data.
- Read a flow log record and name the fields it holds.
- Run queries in Log Analytics to find rejected traffic and byte transfer patterns.
- Save a query so you can run it again with one click.
Hands-on lab
Detect Suspicious Network Traffic with VPC Flow Logs
Included in Cybr Premium.