Google Cloud VPC Flow Logs

Location

Description

Network-flow telemetry for Google Cloud VPC resources, including source and destination addresses, ports, bytes, packets, and decision metadata for accepted traffic samples and aggregates.

Forensic Value

VPC Flow Logs help confirm lateral movement, external communication, and exfiltration volume in Google Cloud when packet capture is unavailable. They are especially useful for mapping suspicious workload-to-workload and workload-to-internet communication patterns across projects and subnets.

Tools Required

Collection Commands

gcloud logging read "logName:compute.googleapis.com%2Fvpc_flows AND timestamp>="2026-03-01T00:00:00Z"" --format=json > gcp_vpc_flow_logs.json

gcloud compute networks subnets describe <subnet-name> --region <region> --format=json > subnet_flow_log_config.json

Collection Constraints

• •VPC Flow Logs are metadata, not packet payloads, and their fidelity depends on subnet configuration and logging settings.
• •Historic flow visibility depends on how long Cloud Logging or export sinks retained the data.

MITRE ATT&CK Techniques

References