VPC Flow Log allows to capture IP traffic for a specific network interface (ENI), subnet, or entire VPC. This module supports enabling or disabling VPC Flow Logs for entire VPC.

While GuardDuty previously primarily analyzed VPC flow logs, CloudTrail events and DNS activities, it now also includes EKS audit logs, runtime information and anomalies in container deployments.

FLI - Flow Logs Insights FLI is a powerful command-line tool that simplifies AWS VPC Flow Logs analysis with intuitive commands, smart filtering, and automatic annotations, turning raw network data ...