Network and Cloud Telemetry Analysis
Network layer
Flow records (NetFlow, IPFIX, VPC Flow Logs) carry metadata only: five-tuple, byte and packet counts, timestamps. They are excellent for beaconing, data-volume anomalies and lateral movement, but they cannot show payload content. Full packet capture and IDS platforms such as Zeek and Suricata emit protocol-level events; DNS, proxy and TLS metadata (SNI, certificate details, JA3/JA4 fingerprints) fill gaps when traffic is encrypted. Without TLS inspection you get metadata, not content - plan detections accordingly.
Cloud layer
Separate the control plane from the data plane. CloudTrail, Azure Activity Logs and GCP Audit Logs record API calls: who changed which resource. VPC flow and DNS cover data-plane traffic. Most cloud intrusions begin in the control plane - a new IAM user, a created access key, a modified role trust policy, or logging being disabled - so control-plane detections are high priority. SaaS audit logs (for example the unified audit log for a productivity suite) reveal consent grants and mailbox rule changes.
Worked example
A host makes 1,440 outbound connections per day to one IP at a near-constant 60-second interval with tightly jittered 2 KB payloads, and no matching DNS lookups. Reasoning: regularity, fixed size and DNS absence point to programmatic beaconing rather than user traffic. Validate against proxy logs for user-agent consistency, and check cloud audit logs to see whether that instance's role credentials were used elsewhere - which would escalate the incident from malware to credential compromise.
Traps that cost marks
- Treating flow logs as content inspection.
- Overlooking DNS as an exfiltration channel via TXT records or long encoded subdomains.
- Assuming provider logs are enabled and retained by default; verify both.
- Focusing on the endpoint while ignoring control-plane changes that grant persistence.