Problem Statement
How do flow logs like NetFlow or VPC Flow Logs help in detection and response?
Explanation
Flow logs show who talked to whom, when, and how much. You spot odd patterns: sudden spikes to unknown IPs, strange ports, or data egress outside business hours. During incidents, flows confirm scope and timing even when packet payloads are unavailable. They also feed baselines that power anomaly alerts. The result is faster triage and better containment decisions.
Code Solution
SolutionRead Only
Example fields: src_ip, dst_ip, src_port, dst_port, proto, bytes, action, start_time, end_time
