How do I tell a security team's authorized scanner from an external attacker?

By source IP ownership and context. An authorized internal scan originates from your own IP ranges; an authorized external scanner from a known vendor's IP range. LogTriage's IP enrichment identifies known commercial scanner infrastructure and flags it differently than a novel external source.

VPC Flow Logs can be expensive at high traffic volume. Can I sample them?

Yes, AWS allows sampling, but sampled logs will miss low-volume targeted scans. A full port scan of one instance may involve only a few dozen REJECT records, which a 1-in-10 sample could miss entirely. For security detection purposes, unsampled logs are strongly preferred.

Does LogTriage support all VPC Flow Log versions?

Yes. LogTriage's VPC Flow parser handles the dynamic header across flow log versions v2 through v5, including additional fields added in later versions. The header row is parsed automatically regardless of which version your flow logs were configured with.

What's the difference between an external port scan and internal reconnaissance after a compromise?

The source IP. External scans originate from outside your VPC's address range; internal pivot scans originate from a private IP inside your VPC that's already been compromised. An internal source IP with a REJECT-heavy scan pattern is typically a higher-priority finding because it implies the perimeter has already been breached.

Detecting Port Scanning in AWS VPC Flow Logs

Why this matters

VPC Flow Logs record the metadata of every accepted and rejected connection in your VPC — not the payload, just who talked to whom, on which port, and whether it was allowed. That’s exactly the right level of detail to catch port scanning, which by definition is about connection attempts, not content. A scan against a well-defended VPC produces almost entirely REJECT records, which is the signal itself.

Indicators to look for in VPC Flow Logs

A single srcaddr generating REJECT records against many distinct dstport values on the same dstaddr in a short window
Sequential or evenly-spaced destination ports, consistent with automated scanning tools rather than normal application traffic
A scan that pivots from internal reconnaissance (scanning other instances in the same VPC) after an initial single-host compromise
A small number of ACCEPT records mixed into a sea of REJECTs — those are the open ports the attacker found, and the ones worth investigating first
Traffic from source ranges with no legitimate business reason to be probing your VPC at all (most scans fall in this category)

How LogTriage detects this

The VPC Flow parser handles the dynamic header across flow log versions v2 through v5, normalizing ACCEPT/REJECT decisions into standard status codes so the same scoring pipeline used for HTTP logs applies here too. NODATA/SKIPDATA records (capacity or internal Amazon traffic) are filtered out automatically so they don’t dilute the signal.

Detection / evidence checklist

List every distinct destination port the source IP attempted, sorted by accept/reject
Identify which ACCEPTed ports correspond to services that shouldn’t be reachable from that source
Check whether the scan originated externally or from an already-compromised instance inside the VPC
Tighten security group rules for any port that was reachable but didn’t need to be
Cross-reference the source IP/ASN against threat intelligence — persistent internet-wide scanners are common and usually lower priority than a scan specifically targeting your IP range

Frequently Asked Questions

How do I tell a security team's authorized scanner from an external attacker?: By source IP ownership and context. An authorized internal scan originates from your own IP ranges; an authorized external scanner from a known vendor's IP range. LogTriage's IP enrichment identifies known commercial scanner infrastructure and flags it differently than a novel external source.
VPC Flow Logs can be expensive at high traffic volume. Can I sample them?: Yes, AWS allows sampling, but sampled logs will miss low-volume targeted scans. A full port scan of one instance may involve only a few dozen REJECT records, which a 1-in-10 sample could miss entirely. For security detection purposes, unsampled logs are strongly preferred.
Does LogTriage support all VPC Flow Log versions?: Yes. LogTriage's VPC Flow parser handles the dynamic header across flow log versions v2 through v5, including additional fields added in later versions. The header row is parsed automatically regardless of which version your flow logs were configured with.
What's the difference between an external port scan and internal reconnaissance after a compromise?: The source IP. External scans originate from outside your VPC's address range; internal pivot scans originate from a private IP inside your VPC that's already been compromised. An internal source IP with a REJECT-heavy scan pattern is typically a higher-priority finding because it implies the perimeter has already been breached.

See this detection run on a real report

Try the live demo with a pre-loaded malicious log set — no signup required — or upload your own log file and get a full AI-reviewed threat report in minutes.

Try Live Demo → Analyze Your Own Logs