In Succession, every power move and every backstab eventually came back to one question: what's on the record? When things went sideways for the Roys, the only way to reconstruct the truth was to go back to the tape. Someone, somewhere, had kept a log of what happened. CIS Safeguard 13.6 is your network's version of that tape.
What Is CIS Safeguard 13.6?
Network traffic flow logs are records of every connection that crosses your network. Source IP, destination IP, port, protocol, bytes transferred, timestamps. Not the content of the conversation, just the record that it happened, when, and how much data moved.
The official CIS language puts it this way: "Collect network traffic flow logs and/or network traffic to review and alert upon from network devices."
Simple sentence, significant lift.
Why It Matters
Most breaches are not discovered in real time. They are discovered weeks or months later, when someone starts asking questions. At that point, your ability to understand what happened depends entirely on what you logged.
Flow logs tell you whether an attacker moved laterally across your network, exfiltrated data to an unusual destination, or communicated with a command-and-control server. Without them, you are reconstructing a crime scene with no evidence.
Beyond incident response, flow logs satisfy audit requirements, support insider threat investigations, and give your security team the visibility to spot trends before they become incidents.
Key Details or How It Works
- NetFlow, IPFIX, and sFlow are the primary protocols used to export flow data from network devices. Most enterprise routers, switches, and firewalls support at least one of these.
- Flow logs capture metadata, not payload. You get source and destination IPs, ports, protocols, packet counts, and byte totals. You do not get the actual content of the traffic. For that, you need full packet capture.
- Cloud environments have native flow logging. AWS VPC Flow Logs, Azure Network Security Group (NSG) Flow Logs, and GCP VPC Flow Logs are built in. Enabling them is usually a few clicks.
- Volume matters. High-traffic networks generate enormous amounts of flow data. Plan your storage and retention strategy before you turn on collection.
- Flow data powers detection. Lateral movement, data exfiltration, beaconing to command-and-control infrastructure. All of these leave signatures in flow logs if you know what to look for.
How to Implement Collect Network Traffic Flow Logs
- Inventory your network devices. Identify every router, switch, firewall, and cloud gateway in scope. Confirm which flow protocols each device supports before you start configuring anything.
- Enable flow export on each device. Configure NetFlow, IPFIX, or sFlow to send data to a centralized collector. Set appropriate sampling rates to balance visibility against data volume.
- Stand up a centralized collector or SIEM. Your flow data needs a destination. A dedicated flow collector, your SIEM, or both. Ensure you have sufficient storage for your retention requirements before the data starts flowing.
- Enable cloud-native flow logging. For AWS, Azure, and GCP environments, turn on the built-in flow logging features. Route those logs to the same centralized destination as your on-premises data so you have a single pane of glass.
- Define and enforce retention policies. Most frameworks require 90 days minimum, with one year common for compliance purposes. Confirm what your regulatory environment requires and set it before your storage fills up with undocumented overruns.
- Build detection logic and alerts. Flow data without alerts is just storage costs. Define what anomalous looks like for your environment and create alerts for large data transfers to unknown destinations, unusual port activity, and new outbound connections to external hosts.
Final Thoughts
The Roys could never fully control what happened to them, in part because they could not control what got recorded by everyone around them. On your network, you have an advantage they never did: you get to decide what goes on the record before something goes wrong. Flow logs are inexpensive compared to a breach investigation. Turn them on, store them long enough to matter, and build the alerts that make the data useful.
Resources
Here is a link to the Policy Templates provided free of charge from the fine folks at the Center for Internet Security.
Looking for even more detail? Here you go. If this still does not satisfy your curiosity, DM me.
Official CIS Text
CIS Control 13: Network Monitoring and Defense Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise's network infrastructure and user base.
CIS Safeguard 13.6: Collect Network Traffic Flow Logs Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.
Shameless Marketing Information
Gotham Technology Group helps organizations build network monitoring programs that go beyond checking a compliance box. From flow log collection and SIEM integration to the detection logic that makes it all actionable, we can help you get real visibility into what is moving across your network. Reach out to find out more.