aws:vpcflow
VPC Flow Logs
- Host type
- AWS
- Tier, as a whole
- Minimum
- Cost class
- Usage billed
- Techniques
- 17
- Rules listed
- 13
- Events
- 0
Why this tier
CISA/ASD priority source; OMB M-26-14 A2 (Network source and destination; our analysis); OMB M-26-14 A7 (Indicators of compromise; our analysis)
Licensing
- License or service
- CloudWatch vended logs
- What is free
- Flow log feature itself
- What costs
- Vended-log delivery per GB (CW Logs tiered from $0.50/GB; S3/Firehose + their storage/processing)
- Notes
- "Data ingestion and archival charges for vended logs apply when you publish flow logs"
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destination | Supports an activity | our analysis |
| OMB M-26-14: Indicators of compromise | Supports an activity | our analysis |
| ASD ACSC / CISA et al.: Priority enterprise log sources | priority_source | quoted (cloud): all network-related events |
Techniques
- T1020.001 Traffic Duplication
- T1021 Remote Services
- T1048 Exfiltration Over Alternative Protocol
- T1074.002 Remote Data Staging
- T1190 Exploit Public-Facing Application
- T1213.006 Databases
- T1496 Resource Hijacking
- T1496.002 Bandwidth Hijacking
- T1498.001 Direct Network Flood
- T1498.002 Reflection Amplification
- T1499 Endpoint Denial of Service
- T1499.002 Service Exhaustion Flood
- T1499.004 Application or System Exploitation
- T1530 Data from Cloud Storage
- T1535 Unused/Unsupported Cloud Regions
- T1537 Transfer Data to Cloud Account
- T1552.005 Cloud Instance Metadata API
Rules
Splunk 3
Microsoft Sentinel 10
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- Detect port misuse by anomaly based detection (ASIM Network Session schema)
- Detect port misuse by static threshold (ASIM Network Session schema)
- Excessive number of failed connections from a single source (ASIM Network Session schema)
- GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema)
- Network Port Sweep from External Network (ASIM Network Session schema)
- Port scan detected (ASIM Network Session schema)
- Potential beaconing activity (ASIM Network Session schema)
- TI Map IP entity to Network Session Events (ASIM Network Session schema)
- TI map IP entity to Network Session Events (ASIM Network Session schema)
Events
No event-level rows: this source is tiered as a whole.