When Cloud Logs Fall Short, Network Telemetry Delivers Critical Security Visibility

Cloud migration promises often include assurances that security will "take care of itself," but reality tells a different story. Dynamic infrastructure, container sprawl, and multi-cloud architectures have introduced new blind spots where attackers operate undetected. When endpoint detection tools fail and cloud-native logs prove inconsistent across providers, security teams face critical visibility gaps. This challenge highlights an enduring truth: network traffic remains the most reliable source of evidence for detecting cloud threats.

"Our cloud research team understands how the sheer volume of API calls and the constant addition of new services across cloud providers make log standardization and analysis a real challenge," explains Vince Stoffer, Field CTO at Corelight. Each cloud provider uses different logging formats and field structures, creating fragmentation that complicates threat detection. Network telemetry solves this by providing a provider-agnostic data layer that behaves consistently across AWS, Azure, GCP, and on-premises environments.

Security analysts already trained in network analysis can immediately apply their skills to cloud network data. When enriched with cloud inventory context—accounts, VPCs, Kubernetes labels—this telemetry creates a unified detection signal. Corelight's Network Detection and Response (NDR) platform operationalizes this approach by normalizing cloud traffic into standardized Zeek logs, enabling behavioral analysis across hybrid environments.

Why Network Visibility Matters in Cloud Security

Even in ephemeral cloud environments, fundamental network patterns persist. Defenders can identify anomalies through:

• Unusual external communications over non-standard ports
• Deviations in immutable container behavior
• Disabled host sensors indicating admin compromise
• Enumeration activity between unrelated services

Unlike host-based logs, network telemetry collected via traffic mirroring remains tamper-resistant. When combined with endpoint and runtime data, it creates detection synergy. Observable threat patterns include:

1. Cryptomining Operations: Beaconing to mining pools via characteristic protocols like Stratum
2. Container Compromise: SSH/RDP/VNC sessions within supposedly immutable containers
3. Credential Theft: Abnormal API calls from new regions or to unfamiliar endpoints
4. Data Exfiltration: Sudden spikes in outbound traffic volume

Building an Effective Visibility Workflow

Implementing cloud network monitoring requires strategic instrumentation:

1. Monitor Critical Flows:

   • East-west traffic (service-to-service)
   • North-south internet ingress/egress
   • Container communications via Kubernetes node visibility
   • TLS metadata (SNI, certificates) for service mapping

2. Operationalize Telemetry:

   • Activate VPC/VNet flow logs and traffic mirroring
   • Centralize data in a platform that normalizes and enriches with cloud tags
   • Establish baselines by service role, ports, and external peers

3. Detection Priorities:

   • Alert on new destinations, ports, or protocols
   • Monitor all egress points for data exfiltration
   • Flag interactive protocols in containers
   • Correlate endpoint compromises with cloud traffic patterns

Continuous validation through adversary emulation ensures detection coverage for threats like C2 callbacks and credential misuse. As cloud architectures evolve, applying network-level visibility principles provides the consistent truth that fragmented logs cannot deliver.

This article was developed from insights shared on Corelight's DefeNDRs podcast. For technical implementation details, explore Corelight's Open NDR Platform.