Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is Flow log?
Flow log is a record of network traffic metadata that shows how data moves between sources, destinations, ports, protocols, and services. It does not usually capture packet contents. Instead, it summarizes connection activity so security teams can investigate behavior without storing full payloads.
In security operations, flow logs help analysts answer simple but critical questions: Who connected to what? When did it happen? Which port was used? Was the traffic allowed or denied? These answers make flow logs useful for detection, incident response, and forensic reconstruction.
What does a Flow log contain?
A flow log typically includes details such as source IP address, destination IP address, source and destination ports, protocol, packet count, byte count, timestamps, and traffic action. Cloud platforms, firewalls, routers, switches, and endpoint security tools may all generate flow-style records.
The exact fields vary by platform. For example, a cloud network flow log may show traffic accepted or rejected by security rules, while a firewall flow record may also include policy names, interface details, or network address translation information.
Why Flow log matters in security operations
Flow logs give security teams visibility into network behavior at scale. They are especially valuable when full packet capture is too expensive, too sensitive, or impractical to retain for long periods.
Security teams use flow logs to:
- Detect unusual outbound connections, lateral movement, and suspicious ports.
- Investigate alerts by tracing communication between systems.
- Validate whether firewall or cloud security rules are working as intended.
- Support incident timelines by showing when network activity started and stopped.
- Identify exposed services, misconfigured assets, or unexpected data paths.
For incident response, this metadata can reveal whether a compromised device contacted a command-and-control server, scanned internal systems, or transferred unusually large volumes of data.
Flow log vs packet capture
| Flow log | Packet capture |
|---|---|
| Records traffic metadata | Records packet-level details |
| Lower storage demand | Higher storage demand |
| Useful for broad monitoring and investigations | Useful for deep technical analysis |
Flow logs are often the first place analysts look because they are easier to search and retain. Packet capture is more detailed, but it is usually reserved for targeted investigations.
How organizations use Flow log data
A flow log becomes more useful when collected centrally and correlated with identity, device, endpoint, and alert data. Security teams often send flow logs to SIEM, SOAR, XDR, or cloud-native logging platforms for detection and investigation.
In managed device environments, platforms such as Hexnode can support broader endpoint visibility and control, while flow logs help security teams understand network-level activity around those devices. Together, this context improves response decisions, especially when isolating risky endpoints or validating policy enforcement.
FAQs
Not always. A firewall log may include flow-like traffic details, but it can also include rule names, threat verdicts, user details, and policy actions depending on the firewall platform.
Flow logs do not identify malware by themselves, but they can reveal suspicious behavior such as repeated beaconing, unusual destinations, abnormal ports, or unexpected data transfer patterns.
Retention depends on risk, compliance needs, storage cost, and investigation requirements. Many teams keep recent logs hot for fast search and archive older logs for forensic review.
