# VPC Flow Logs Published articles for VPC Flow Logs. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation DevFeed: [Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation]() Original publisher: [Read original article]() Author: Nisha Kashyap Published: 2026-08-26T17:39:19Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services (AWS)](), [Security](), [Detection engineering](), [Amazon CloudWatch Logs](), [AWS CloudTrail](), [VPC Flow Logs](), [Amazon S3](), [data]() Tags: [advanced-300](), [amazon-cloudwatch](), [amazon-cloudwatch-logs](), [amazon-guardduty](), [amazon-route-53](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [aws-security-hub](), [best-practices](), [cybersecurity](), [guide](), [incident-response](), [logs](), [s3](), [security](), [security-blog](), [security-identity-compliance](), [shared-responsibility-model](), [technical-how-to](), [threat-detection](), [vpc-flow-logs]() ### AI overview This article explains how security engineers can detect multi-stage attacks on AWS by correlating signals across services with business context. It presents examples using CloudWatch Logs Insights and discusses expanding the correlations into an automated pipeline. ### Source excerpt A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack. Consider a short sequence. An identity calls GetCallerIdentity from a source address it hasn't previously used. Within minutes, [...] ## Encrypt Amazon ECS traffic: VPC encryption controls and Service Connect TLS DevFeed: [Encrypt Amazon ECS traffic: VPC encryption controls and Service Connect TLS]() Original publisher: [Read original article]() Author: Simone Tallevi-Diotallevi Published: 2026-08-19T20:37:56Z Content type: tutorial Language: en Sources: [Containers]() Topics: [Cryptography]() Tags: [advanced-300](), [amazon-elastic-container-service](), [amazon-vpc](), [aws](), [aws-fargate](), [containers](), [encryption](), [how-to](), [logs](), [nitro-system](), [security](), [technical-how-to](), [tls](), [vpc](), [vpc-flow-logs]() ### AI overview A hands-on guide to encrypting traffic between Amazon ECS workloads with VPC encryption controls or Service Connect TLS. It covers activation on AWS Fargate and verification through VPC Flow Logs. ### Source excerpt Learn how to encrypt traffic between Amazon ECS workloads using two native approaches: VPC encryption controls for network-layer encryption through the AWS Nitro System, and Service Connect TLS for application-layer encryption. A hands-on walkthrough shows how to activate encryption on AWS Fargate and verify it in VPC Flow Logs. ## Normalize security logs to Google SecOps UDM with Observability Pipelines DevFeed: [Normalize security logs to Google SecOps UDM with Observability Pipelines]() Original publisher: [Read original article]() Author: Danielle Park Published: 2026-07-27T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [telemetry]() Tags: [amazon-vpc](), [google-cloud](), [google-secops](), [logs](), [mapping](), [observability-pipelines](), [security](), [telemetry](), [threat-detection](), [vpc-flow-logs]() ### AI overview The article explains how Observability Pipelines Google SecOps packs normalize security logs into the Unified Data Model before they reach Google SecOps. ### Source excerpt Learn how Observability Pipelines normalizes your telemetry to Google SecOps UDM, enabling both consistent investigations across sources and precise upstream control over your SIEM ingest. ## Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs DevFeed: [Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs]() Original publisher: [Read original article]() Author: Aurelien Cerveaux Published: 2022-09-15T06:39:58Z Content type: tutorial Language: en Sources: [betclic-tech - Medium]() Topics: [AWS CloudTrail](), [Amazon Web Services](), [VPC Flow Logs](), [Amazon S3](), [AWS CloudFormation](), [DynamoDB](), [JSON]() Tags: [amazon-s3](), [athena](), [aws](), [aws-cloudtrail](), [cloud](), [cloudformation](), [cloudtrail](), [dynamodb](), [events](), [json](), [vpc-flow-logs]() ### AI overview A tutorial explains how to automate daily AWS Athena partition creation for organization-level CloudTrail and VPC Flow Logs. It describes using Amazon S3, AWS Glue Data Catalog, CloudFormation, SAM, Lambda, DynamoDB, and EventBridge to improve query efficiency and reduce scanned data and cost. ### Source excerpt This article's goal is to explain how to query efficiently, and at low cost with AWS Athena, AWS CloudTrail logs, or VPC Flow logs by automating the creation of Athena partitions daily. AWS CloudTrail AWS CloudTrail is a service that records all API Calls and Events for AWS Accounts, including details on calls made to your AWS Services and the Console as well. Activated at the Organization level, CloudTrail logs help you in several cases: Simplified Compliance Summarizing Accesses Security Analysis and Troubleshooting Monitoring Users and Resources Activities Governance and Investigation CloudTrail Logs are delivered in an S3 Bucket in JSON format through many small files that make these difficult to operate and request. VPC Flow Logs VPC Flow Logs is a feature that allows you to capture traffic information going to and from your network interfaces in your VPC. It helps you to: Analyze and troubleshoot network issues Determine the direction of your traffic Monitor the traffic Like CloudTrail Logs, Flow Logs are published in an S3 Bucket for all accounts in the Organization. AWS Athena AWS Athena is a query service that permits you to analyze data directly in an Amazon S3. You can create tables in Athena which use AWS Glue Data Catalog and are based on an S3 location. To query efficiently and with less scanned data and optimize the cost, we need to create some partitions. To know more about Tables, Databases, and Catalog in Athena. Automate Partitions Creation In our case, we are using CloudTrail Logs and VPC Flow Logs to detail the solution and the source code. All is done in CloudFormation and using SAM to deploy the Lambda. Global Overview We have several parts to automate the creation of our partitions. A common part containing: The Lambda is used to create partitions concerning different log types A DynamoDB table used to store partition names A specific part for each log type contains: The Glue Table with the proper structure An EventBridge Rule to trigger the