AWS VPC Flow Logs

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/cloud-aws-vpc-flow/generator.yml \
  --id vpcflow \
  --live-mode true

Event Types

Realism Features

• Weighted port distributions — HTTPS dominates at ~35%, followed by DNS, HTTP, SSH, and 17 other services
• Lognormal traffic volumes — packets and bytes follow lognormal distributions; bulk transfers produce 10KB–500MB flows
• Network direction detection — classifies flows as inbound, outbound, internal, or external based on RFC 1918 analysis
• Multi-account environment — 3 AWS accounts (production, staging, development) across 5 regions
• 15 network interfaces spanning 3 VPCs with EC2, NAT gateway, ALB, Lambda, and ECS task ENI types
• Raw log preservation — event.original contains the v2 space-delimited format matching CloudWatch/S3 delivery

Sample Output

{
    "@timestamp": "2026-03-04T14:22:31+00:00",
    "cloud": {
        "account": { "id": "123456789012", "name": "acme-production" },
        "availability_zone": "use1-az2",
        "provider": "aws",
        "region": "us-east-1"
    },
    "event": {
        "action": "accept",
        "category": ["network"],
        "dataset": "aws.vpcflow",
        "outcome": "success",
        "type": ["connection", "allowed"]
    },
    "network": {
        "bytes": 18560,
        "direction": "outbound",
        "iana_number": "6",
        "transport": "tcp"
    },
    "source": { "ip": "10.0.1.47", "port": 49832 },
    "destination": { "ip": "52.94.233.17", "port": 443 }
}

Parameters