Skip to content

[AWS VPC Flow] Support newer VPC log formats #14835

@jamiehynds

Description

@jamiehynds

Our current VPC flow log integration supports version 5, which is now outdated. AWS has since released versions 6 and 7, introducing new metadata fields for Transit Gateway and ECS workloads. To stay current and provide more complete visibility, our integration should be updated to support and normalize these additional fields where applicable.

Version 6
This was introduced to provide enhanced visibility for AWS Transit Gateway (TGW) flows. It adds 18 new fields related to TGW-specific metadata, making it easier to analyze traffic that crosses and connects through Transit Gateway architectures

Version 7
This version was introduced to surface metadata for workloads running on Amazon Elastic Container Service (ECS). It adds 10 new ECS-specific fields, including:

ecs-cluster-arn, ecs-cluster-name
ecs-task-id, ecs-task-arn
ecs-task-definition-arn, ecs-service-name
ecs-container-id, ecs-second-container-id

Can we please update our integration with VPC flow to ensure we're up to date with the latest formats, and claim support for v6 and v7 log formats.

Metadata

Metadata

Labels

Integration:awsAWSTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]enhancementNew feature or request

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions