AWS Flow Logs

Support is enabled in Configuration Center > FMC Configuration > AWS Flow Logs. Logs are periodically downloaded, converted to IPFIX, and sent to the specified listening port of the local collector. The table below specifies how AWS Flow Logs fields are mapped to supported IPFIX fields. Fields not included in the table are not mapped.

Field	Maps to, in IPFIX	Collector Configuration
version	No mapping	Not supported
account-id	No mapping	Not supported
interface-id	No mapping, replaced by a generated value for IPFIX_ingressInterface	Collected by default
srcaddr	IPFIX_SourceIPv4Address IPFIX_SourceIPv6Address	Collected by default
dstaddr	IPFIX_DestinationIPv4Address IPFIX_DestinationIPv6Address	Collected by default
srcport	IPFIX_SourceTransportPort	Collected by default
dstport	IPFIX_DestinationTransportPort	Collected by default
protocol	IPFIX_protocolIdentifier	Collected by default
packets	IPFIX_packetTotalCount	Collected by default
bytes	IPFIX_octetTotalCount	Collected by default
start	IPFIX_flowStartMilliseconds	Collected by default
end	IPFIX_flowEndMilliseconds	Collected by default
action	IPFIX_firewallEvent	Not supported
log-status	No mapping	Not supported
tcp-flags	IPFIX_tcpControlBits	Collected by default