Question

A security team stores VPC Flow Logs in a CloudWatch Logs log group. After a suspected exfiltration attempt, they need to quickly identify the top 10 source IP addresses generating the most REJECTED traffic to a specific destination port over the last 6 hours, and they want to run this ad hoc without provisioning any additional infrastructure. Which approach meets these requirements with the least operational effort?

Accepted Answer

Use CloudWatch Logs Insights with a query that filters on the reject action and destination port, aggregates counts by source address, sorts descending, and limits results to 10.

Answer

Create a metric filter on the log group that matches rejected packets, then build a CloudWatch dashboard widget grouped by source IP.

Answer

Export the log group to Amazon S3 and run an Amazon Athena query against the exported flow logs to aggregate rejected traffic by source IP.

Answer

Stream the log group through a Kinesis Data Firehose subscription filter to OpenSearch Service and build a Kibana visualization of rejected connections.