NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cloud Security
Flow Log Analysis and Network Detection
Master VPC Flow Log analysis. Learn to query network telemetry, detect port scanning, and identify lateral movement and data exfiltration in the cloud.
Room tasks
1What Is Flow Log Analysis and Why Does It Matter
2Reading VPC Flow Logs and NSG Flow Logs
3Guided Lab: Detecting Lateral Movement from Flow Log Data
Frequently Asked Questions
What are VPC flow logs?
VPC flow logs record metadata about IP traffic going to and from network interfaces, including addresses, ports, protocol and whether traffic was accepted or rejected. They do not capture payloads.
How do you detect port scanning in flow logs?
Look for a single source contacting many ports or hosts in a short time, often with many rejected connections. Query tools such as Athena make these patterns easy to aggregate and review.
Can flow logs reveal lateral movement?
Yes. Unusual internal connections between hosts that normally do not communicate, or sudden access to management ports, can signal lateral movement. The free Codelivly room shows how to query for it.