Collect Network Traffic Flow Logs
Description
Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
Implementation Checklist
Tool Recommendations
SIEM platform with log management, threat detection, investigation, and compliance reporting across enterprise data sources
Cisco (Splunk) · Ingest-based or workload-based
Cloud-native SIEM and SOAR with AI-driven analytics, automated threat response, and native Azure/M365 integration
Microsoft · Pay-as-you-go (per GB ingested)
AI-driven network detection and response with self-learning threat analysis and autonomous response
Darktrace · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Covert Data Exfiltration via Unusual Traffic Patterns
ConfidentialityAn attacker slowly exfiltrates sensitive data using low-and-slow techniques over legitimate ports, and the abnormal traffic volume goes unnoticed because network flow logs are not collected or analyzed.
Undetected Reconnaissance Scanning of Internal Network
ConfidentialityAn attacker conducts port scans and service enumeration across the internal network after initial compromise, and the scanning activity is invisible because no network traffic flow logging is in place.
Unauthorized Communication to Known Malicious Infrastructure
IntegrityA compromised system communicates with known threat actor infrastructure, but the outbound connections are never flagged because network flow data is not captured for threat intelligence correlation.
Vulnerabilities (When Safeguard Absent)
No Network Flow Visibility
Without collecting NetFlow or equivalent traffic flow logs, security teams cannot identify abnormal communication patterns, traffic volumes, or unauthorized connections between internal and external systems.
Inability to Perform Retrospective Network Analysis
Absence of historical network traffic flow data prevents forensic investigation of when compromise began, what systems communicated with attacker infrastructure, and what data may have been exfiltrated.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Detection tool deployment evidence (dashboard screenshots, agent status) | Captured monthly |
| Technical | Sample alert/detection output demonstrating capability | Captured quarterly |
| Technical | SIEM dashboard showing log sources and collection status | Captured monthly |
| Record | Log review records and findings | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |