Network Flows
Overview
Section titled “Overview”Network Flows shows how traffic moves through your cloud networks. It turns the VPC flow logs and other network logs that Fencer’s SIEM ingests into a traffic flow diagram, a map of where clients connect from, and a set of Network Intelligence widgets that point out blocked requests, unusual DNS activity, and unexpected outbound traffic.
You open it from Operations > Network Flows.
Prerequisites
Section titled “Prerequisites”- An active subscription with the SIEM feature enabled.
- The
detections:readability, which the built-in Administrator, Team Member, and Read Only roles have. - For the flow diagram and the flow statistics: an AWS VPC Flow Logs or GCP VPC Flow Logs data source. See AWS Log Sources and GCP Log Sources.
- For the other widgets: the log source each one reads, listed in Network Intelligence widgets.
How it works
Section titled “How it works”Fencer aggregates the flow records of your connected data sources over the time range you choose. Records from AWS and GCP VPC flow logs are merged, so one diagram covers both clouds. Each widget runs its own query, so a widget whose log source is not connected shows an empty state while the rest of the page still loads.
Usage / Configuration
Section titled “Usage / Configuration”Choosing the time range
Section titled “Choosing the time range”The time range at the top of the page applies to everything on it. Choose Last hour, Last 24 hours, Last 7 days, or Last 30 days. The default is Last 24 hours.
Reading the summary
Section titled “Reading the summary”Above the diagram, a row of figures sums up the range:
- Traffic — the bytes transferred, and how many endpoints took part.
- Connections — the number of connections, and their average size.
- External providers — the distinct networks your organization exchanged traffic with, and the number of countries the endpoints are in.
- Top talker — the endpoint with the most traffic, and its bytes.
- Blocked connections — connections the flow logs record as rejected or denied. Needs review marks a range with blocked connections.
Using the traffic flow diagram
Section titled “Using the traffic flow diagram”The Traffic flow card draws your hosts and what they exchange traffic with. Its controls are:
- Group by — Providers groups external addresses by the network that owns them, such as a cloud provider. Endpoints shows the individual addresses. The default is Providers.
- Measure — Bytes sizes each link by bytes transferred, Connections by the number of connections. The default is Bytes.
- Diagram — Flow draws a flow diagram from sources to destinations. Map draws a network graph. The default is Flow.
The legend marks Internal and External endpoints and Blocked traffic. Hover over a link to see its traffic, connections, and packets, and whether the traffic was allowed or blocked.
Seeing where clients connect from
Section titled “Seeing where clients connect from”The Geographic distribution card plots the clients that connect to your Application Load Balancers, from AWS ALB Connection Logs. A location is either Precise location or a Country-level estimate. The card also says how many clients could not be mapped.
Network Intelligence widgets
Section titled “Network Intelligence widgets”Below the diagram, the Network intelligence section holds these widgets:
| Widget | What it shows | Log sources it reads |
|---|---|---|
| Load Balancer Error Rate | 4xx and 5xx responses as a share of all requests, over time | AWS ALB Access Logs |
| DNS Query Volume | Top talkers by query count, and High-entropy subdomains | AWS Route53 DNS Query Logs, GCP Cloud DNS Logs |
| Top Blocked Request URIs | The request paths denied most often | GCP Cloud Armor Logs |
| Top Internal-to-Internal VPC Flows | The highest-volume source and destination pairs between private endpoints | AWS VPC Flow Logs, GCP VPC Flow Logs |
| Top Source IPs | The source IPs with the most events | Your infrastructure log sources, such as VPC flow, DNS, ALB, Cloud Armor, firewall, CloudTrail, and S3 access logs |
| Unexpected Egress | Allowed outbound traffic from private hosts to public destinations on ports other than 80, 443, 53, and 123 | AWS VPC Flow Logs, GCP VPC Flow Logs |
| Inbound Traffic Volume | The source IPs that sent the most bytes in | AWS VPC Flow Logs, GCP VPC Flow Logs |
| Egress Traffic Volume | The destination IPs that received the most bytes out | AWS VPC Flow Logs, GCP VPC Flow Logs |
Examples
Section titled “Examples”Checking for unexpected outbound traffic after an incident:
- Go to Operations > Network Flows and choose Last 7 days.
- In Unexpected Egress, look for private hosts sending traffic to public addresses on unusual ports.
- In the Traffic flow card, set Group by to Endpoints and Measure to Connections to see which hosts that traffic came from.
- Search for the destination address in Operations > Threat Hunting to review the raw flow records. Threat Hunting hides AWS VPC Flow Logs by default, so remove that filter first. See Threat Hunting.
Troubleshooting
Section titled “Troubleshooting”- “No network flows in this range” — No VPC flow log records match the range. Connect an AWS or GCP VPC flow logs data source, or choose a longer time range.
- A widget is empty while others show data — The widget’s log source is not connected, or it has no records in the range. Check the table above for the source each widget reads.
- A widget says it took too long to load — Choose a shorter time range, then try again.