c4.7 Analyze network flows
Monitor traffic metadata with VPC Flow Logs, and capture full packets with Traffic Mirroring when you need deep analysis. Route the logs to CloudWatch, S3 (via Firehose) for Athena queries, or your SIEM to detect anomalies and investigate incidents.
Implementation guidance
See how traffic actually flows
VPC Flow Logs capture metadata about the IP traffic in your VPC — agentless, and enable-able at the VPC, subnet, or network-interface level, filtered to all, accepted, or rejected traffic. For deep analysis, Traffic Mirroring captures full packets.
Route the logs where you can use them
Send Flow Logs to Amazon CloudWatch Logs, or to an Amazon S3 bucket via Amazon Data Firehose for querying with Amazon Athena. Many SIEMs (Splunk, QRadar) can also ingest Flow Logs — connect this to your SIEM / Security Lake so flow data supports both detection and investigation. Enriching Flow Logs with security group IDs makes them far easier to analyze; see how to visualize and refine your network's security.
How to validate
- Are VPC Flow Logs enabled where you need network visibility?
- Are the logs routed somewhere you can query them (CloudWatch, S3/Athena, or your SIEM)?
- Do you use full-packet capture (Traffic Mirroring) where deep analysis is required?
Threats addressed
- Without network flow visibility, lateral movement, data exfiltration, and command-and-control traffic can occur unseen, and incident investigation lacks the network context needed to scope an event.
AWS services
Amazon Security Lake 
Amazon CloudWatch 
Amazon S3 Pricing
VPC Flow Logs bill through the destination (CloudWatch Logs or S3). See Amazon CloudWatch pricing.