Glossary term
VPC Flow Logs
Sampled network flow records for Google Cloud VPC subnets: IPs, ports, protocol, estimated bytes and packets. No payload; only where enabled beforehand.
VPC Flow Logs record samples of network flows sent and received by VM instances and other VPC endpoints. Each record (log compute.googleapis.com/vpc_flows) holds the 5-tuple in connection, estimated bytes_sent and packets_sent, the reporting side (SRC or DEST), VM details and, for public IPs, location and ASN.
They are enabled per subnet, network or organization, sampled, aggregated over intervals (5 seconds by default) and carry no payload. In an investigation they are the only Google Cloud log showing what a compromised VM sent over the network, and they let analysts match attacker IPs from audit logs with VM traffic.