AWS Flow Logs

Support is enabled in Configuration Center > FMC Configuration > AWS Flow Logs. Logs are periodically downloaded, converted to IPFIX, and sent to the specified listening port of the local collector. The table below specifies how AWS Flow Logs fields are mapped to supported IPFIX fields. Fields not included in the table are not mapped.

Field	Maps to, in IPFIX
version	No mapping
account-id	No mapping
interface-id	No mapping, replaced by a generated value for IPFIX_ingressInterface
srcaddr	IPFIX_SourceIPv4Address IPFIX_SourceIPv6Address
dstaddr	IPFIX_DestinationIPv4Address IPFIX_DestinationIPv6Address
srcport	IPFIX_SourceTransportPort
dstport	IPFIX_DestinationTransportPort
protocol	IPFIX_protocolIdentifier
packets	IPFIX_packetTotalCount
bytes	IPFIX_octetTotalCount
start	IPFIX_flowStartMilliseconds
end	IPFIX_flowEndMilliseconds
action	IPFIX_firewallEvent
log-status	No mapping
tcp-flags	IPFIX_tcpControlBits