Home/Templates/Keep network records long enough to be useful
Keep network records long enough to be useful
Traffic records stored cheaply for months, in a format you can query.
Terraform
Why bother
Working out how far an attacker got needs network records from before you knew anything was wrong. Default retention is usually a few days, which is shorter than the time most intrusions go unnoticed.
How you know it worked
Ask for traffic from a host thirty days ago and get rows back.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | VPC flow logs to S3 in Parquet format |
| Azure | Virtual network flow logs with traffic analytics |
| Google Cloud | VPC flow logs to a log bucket |
| Oracle Cloud | VCN flow logs to the Logging service |