Flowlog-Stats analyzes your AWS network data

Hello world and welcome to Flowlog-Stats! The team is putting the final polishing touches on our product and are excited to start talking about Flowlog-Stats. Today, we’ll share what we do and how we do it.

What we do: transform a sea of network data from AWS into actionable graphs and charts

Flowlog-Stats enables you to troubleshoot and analyze your AWS cloud infrastructure.  All you need to do is enable AWS Flow Logs (more info: Flow log Intro, Flowlog Docs) and give us read access to the VPCs you want us to analyze.  In just two steps, you’re all set-up!

Flow Logs are today’s equivalent of the NetFlow information that was traditionally collected by the network layer on your infrastructure’s traffic. When we all transitioned to the cloud, this information used in monitoring the health and security of your network just wasn’t available anymore. In 2015, this changed when AWS released the Flow Logs feature that provides network meta data information such as source/destination IP, port, udp/tcp, byte size, etc. for each EC2 instance through CloudWatch.

flowlog-flow

Unfortunately for us security analysts, AWS provides a really primitive interface to look at all this information.  There is an API to pull the information but no easy way to analyze it.

flowlog-aws

FlowLog-Stats takes this sea of data and provides you with useful charts and graphs about what is going on with your cloud infrastructure.

How we do it: the network visualization tools that FlowLog-Stats creates daily

Top Traffic Sources: top 10 traffic by source, rejected, and traffic.  These are the default charts typically provided by other log analyst solutions.

fl-top-10.png

Top Traffic Locations: infographic illustrating where the traffic in your network is coming from and going

fl-mpa.png

Traffic Flow: visualize which IPs are talking to each other and how much they are talking to each other with this chord diagram.

chord-1-corner.png

Threat Identification: ranked list of the highest threat IPs that your network is talking to. These threatening IP lists are published and updated frequently; FlowLog-Stats continually checks these lists so you don’t have to.

malicious_ip_list.png

Does this sound useful to you? What other information do you want FlogLog-Stats to provide? Please let us know in the comments!

Advertisements