AWSVPCFlow

AWSVPCFlow Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel VPC Flow Logs, which ingested from Sentinel’s connector, enables you to capture IP traffic going to and from your AWS VPC network interfaces.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AccountId The AWS account ID of the owner of the source network interface for which traffic is recorded. If the network interface is created by an AWS service, for example when creating a VPC endpoint or Network Load Balancer, the record may display unknown for this field. String
Action The action that is associated with the traffic. String
AzId The ID of the Availability Zone. String
Bytes The number of bytes transferred during the flow. Int64
DstAddr The destination address for outgoing traffic. String
DstPort The destination port of the traffic. Int32
End The time when the last packet of the flow was received within the aggregation interval. DateTime
FlowDirection The direction of the flow with respect to the interface where traffic is captured. String
InstanceId The ID of the instance that’s associated with network interface for which the traffic is recorded. String
InterfaceId The ID of the network interface for which the traffic is recorded. String
LogStatus The logging status of the flow log. String
Packets The number of packets transferred during the flow. Int32
PktDstAddr The packet-level (original) destination IP address for the traffic. String
PktDstAwsService The name of the subset of IP address ranges for the PktDstAddr field, if the destination IP address is for an AWS service. String
PktSrcAddr The packet-level (original) source IP address of the traffic. String
PktSrcAwsService The name of the subset of IP address ranges for the PktSrcAddr field, if the source IP address is for an AWS service. String
Protocol The IANA protocol number of the traffic. Int32
Region The Region that contains the network interface for which traffic is recorded. String
SourceSystem String
SrcAddr The source address for incoming traffic. String
SrcPort The source port of the traffic. Int32
SublocationId The ID of the sublocation that contains the network interface for which traffic is recorded. String
SublocationType The type of sublocation that is returned in the sublocationId field. String
SubnetId The ID of the subnet. String
TcpFlags The bitmask value for the following TCP flags. Int32
TenantId String
TimeGenerated The timestamp (UTC) of when the event was generated. This value will be the same as ‘start’ input field or the data arrival time to Azure Monitor in case the ‘start’ input field is empty or missing. DateTime
TrafficPath The path that egress traffic takes to the destination. String
TrafficType The type of traffic. The possible values are: IPv4, IPv6, and EFA. For more information search for ‘Elastic Fabric Adapter (EFA)’. String
Type The name of the table String
Version The VPC Flow Logs version. Int32
VpcId The ID of the VPC. String

Schema changes #

Date Action
2024-10-18 Table added to tracking