AWS VPC Flow Logs
Go to Services -> VPC
:
Select a relevant VPC and under Flow Logs tab and click on Create flow log button. Then create a new flow log.
Go to AlphaSOC Console > Sources > AWS and use the provided S3 bucket ARN as a destination. It looks like this:
arn:aws:s3:::alphasoc-incoming-events/<token>/
Select a "Custom format" and provide (at least) the following fields:
${version} ${start} ${pkt-srcaddr} ${srcaddr} ${dstaddr} ${pkt-dstaddr} ${srcport} ${dstport} ${protocol} ${bytes} ${instance-id} ${action} ${tcp-flags}