Key Takeaways
- VPC Flow Logs are your cloud network tap. They record accepted and rejected IP traffic across your VPC, the data plane CloudTrail does not cover.
- Flow Logs can go to S3 or CloudWatch, and Wazuh collects from either, parsing source, destination, ports, bytes and action.
- Network detections include data exfiltration (large outbound transfers), command-and-control beaconing, port scanning, and traffic to or from known-bad IPs.
- Rejected-traffic patterns reveal reconnaissance and attempts to reach blocked services, useful early-warning signals.
- Flow Logs complement CloudTrail: the API trail shows control-plane actions, Flow Logs show what actually moved on the network.
Why VPC Flow Logs Are Essential
CloudTrail tells you what happened at the AWS API level, but it says nothing about the actual network traffic between your instances, services and the internet. For that you need VPC Flow Logs, which record metadata about the IP traffic going to and from network interfaces in your VPC: source and destination addresses and ports, protocol, byte and packet counts, and whether each flow was accepted or rejected.
This is your network visibility in the cloud, the equivalent of netflow on-premise. It is where you see the data-plane signals of an attack that never appear in the control-plane trail: an instance exfiltrating data, malware beaconing to a command-and-control server, lateral movement between subnets, or scanning activity. Monitoring VPC Flow Logs with Wazuh brings cloud network detection into your SOC.
Sending VPC Flow Logs to Wazuh
VPC Flow Logs can be published to either an S3 bucket or CloudWatch Logs, and Wazuh can collect from either. For S3 delivery, configure the Wazuh AWS module to read the flow-log bucket with the VPC Flow Log type; for CloudWatch delivery, use the CloudWatch Logs integration against the flow-log group. S3 is often preferred for high-volume flow logs because of cost and batch handling, but both work.
Wazuh parses each flow record into structured fields: source and destination IP and port, protocol, bytes, packets, the action (ACCEPT or REJECT), and the interface. These fields are what detection rules match on. Enable Flow Logs at the VPC or subnet level for broad coverage, and consider the default versus a custom log format depending on the fields you want. Use least-privilege read-only access to the chosen destination.
Need Your AWS Connected to Wazuh?
Codesecure specialises in Wazuh cloud monitoring: CloudTrail, CloudWatch, Config, VPC Flow Logs, S3, EC2, RDS and MongoDB Atlas, wired into one SOC with least-privilege IAM and tuned detections. ISO/IEC 27001:2022 certified delivery, named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
See Cloud SOC Services →Network Threat Detections
VPC Flow Logs enable a set of network detections that complement your other AWS monitoring. Data exfiltration shows up as unusually large outbound transfers, especially to unfamiliar external destinations, which a rule can catch by alerting on high outbound byte counts to non-allowlisted IPs. Command-and-control traffic often appears as regular, periodic outbound connections (beaconing) to a single external host, a pattern worth hunting for.
Port scanning and reconnaissance appear as one source touching many ports or many destinations in a short time, or as a burst of REJECT records. Traffic to or from known-bad IPs is caught by enriching flow records with threat intelligence, matching source and destination addresses against malicious-IP feeds in MISP or similar. Together these cover exfiltration, C2, scanning and known-bad communication, the core network attack signals.
What Rejected Traffic Tells You
The ACCEPT and REJECT action field is more useful than it first appears. Rejected flows are connections that your security groups or network ACLs blocked, and patterns in them are valuable early warning. A single source generating many rejects across different ports or instances is probing your defences, mapping what is open. A compromised internal instance trying and failing to reach external services may show as rejects outbound.
Watching rejected traffic lets you see reconnaissance and attempted lateral movement before anything succeeds, which is exactly the early-stage visibility a SOC wants. It also surfaces misconfigurations and unexpected connection attempts that are worth investigating even when benign. Build rules that alert on anomalous volumes or patterns of rejected flows, not just accepted ones, to use the full signal in the data.
Handling Flow Log Volume
VPC Flow Logs can be extremely high volume in a busy environment, since they record every flow. This is the main practical challenge. Manage it by scoping where you enable Flow Logs (you may not need them on every subnet at the same fidelity), by using S3 delivery for cost-effective bulk handling, and by designing your Wazuh collection and retention with the volume in mind.
In Wazuh, apply the usual discipline of separating storage from alerting: retain flow data for investigation and compliance, but write detection rules that aggregate and threshold rather than alerting on individual flows. Use frequency and correlation rules so that the signal (an exfiltration burst, a beacon pattern) rises above the constant background of normal traffic. With sensible scoping and tuning, flow-log monitoring is sustainable and high value.
Cloud Logs Flowing But No Detections?
Collecting CloudTrail or VPC Flow Logs is only step one. Our SOC lead will review your AWS log coverage and detection gaps on a 30-minute free scoping call. No obligation, no slideware.
Book a Free Scoping Call →Flow Logs Plus the Rest of AWS
VPC Flow Logs are most powerful alongside your other AWS sources in Wazuh. Correlate a flow-log exfiltration signal with a CloudTrail credential anomaly on the same instance, or a beaconing pattern with a GuardDuty finding, and isolated alerts become a clear incident. The network view fills in what the control-plane and host views cannot see, and the host view (from the Wazuh agent on EC2) fills in what the network cannot.
A complete cloud SOC on Wazuh watches the control plane (CloudTrail, Config), the network (VPC Flow Logs), the managed services (RDS, Lambda via CloudWatch) and the hosts (EC2 agents), and correlates across all of them. Flow Logs are the network layer of that picture, and essential for catching the data movement that defines the most damaging incidents.
Frequently Asked Questions
How do I send VPC Flow Logs to Wazuh?
Publish VPC Flow Logs to either an S3 bucket or CloudWatch Logs. For S3, configure the Wazuh AWS module to read the flow-log bucket with the VPC Flow Log type; for CloudWatch, use the CloudWatch Logs integration against the flow-log group. Wazuh parses each record into fields (source, destination, ports, bytes, action) for detection. S3 is often preferred for high-volume flow logs.
What can Wazuh detect from VPC Flow Logs?
Network-level threats that CloudTrail cannot see: data exfiltration (large outbound transfers to unfamiliar destinations), command-and-control beaconing (regular periodic connections to one external host), port scanning and reconnaissance (one source touching many ports or hosts), and traffic to or from known-bad IPs when enriched with threat intelligence.
Why do rejected flows in VPC Flow Logs matter?
Rejected flows are connections blocked by security groups or network ACLs, and patterns in them give early warning. A source generating many rejects across ports or instances is probing your defences, and a compromised instance may show failed outbound attempts. Alerting on anomalous rejected-traffic patterns reveals reconnaissance and attempted lateral movement before anything succeeds.
Should VPC Flow Logs go to S3 or CloudWatch for Wazuh?
Both work with Wazuh. S3 delivery is often preferred for high-volume flow logs because it handles bulk data cost-effectively and in batches, which suits the volume Flow Logs generate. CloudWatch delivery is convenient if you already centralise there. Choose based on your volume, cost and existing logging architecture.
How do I handle the high volume of VPC Flow Logs?
Scope where you enable Flow Logs rather than everywhere at full fidelity, use S3 delivery for cost-effective bulk handling, and in Wazuh separate storage from alerting. Write detection rules that aggregate and threshold (frequency and correlation rules for exfiltration bursts or beaconing) instead of alerting on individual flows, so signal rises above normal traffic.
Can Codesecure set up VPC Flow Log monitoring in our Wazuh?
Yes. Codesecure configures VPC Flow Log collection into Wazuh and builds detections for exfiltration, command-and-control beaconing, scanning and known-bad traffic, with threat-intel enrichment and tuning for volume. ISO/IEC 27001:2022 certified delivery with named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
See The Network Traffic Attackers Hope You Miss
Codesecure connects VPC Flow Logs to Wazuh and builds detections for data exfiltration, C2 beaconing, scanning and known-bad traffic, enriched with threat intelligence and tuned for volume. Delivered by named OSCP, CEH and CISSP consultants.
