# Flow Log Analysis and Network Detection

> Master VPC Flow Log analysis. Learn to query network telemetry, detect port scanning, and identify lateral movement and data exfiltration in the cloud.

Canonical: https://codelivly.com/rooms/flow-log-analysis-and-network-detection
Last updated: 2026-09-25

| | |
|---|---|
| Level | Intermediate |
| Category | Cloud Security |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This intermediate module dives into the critical practice of network detection using cloud-native telemetry. You will learn how to enable, configure, and analyze VPC Flow Logs to uncover hidden threats. The curriculum covers writing efficient queries in Amazon Athena and CloudWatch Logs, detecting network anomalies like port scanning, data exfiltration, and command-and-control (C2) beaconing, and establishing baseline network behavior to identify sophisticated lateral movement. By mastering flow log analysis, you will transform raw network metadata into actionable security intelligence.

## Lessons

1. What Is Flow Log Analysis and Why Does It Matter (30 min)
2. Reading VPC Flow Logs and NSG Flow Logs (30 min)
3. Guided Lab: Detecting Lateral Movement from Flow Log Data (30 min)

## Related

- [Learning path: Cloud Networking Attack Surface](https://codelivly.com/learning-paths/cloud-networking-attack-surface)
- [All rooms](https://codelivly.com/rooms)