Module 5 of 6 · CloudRuler Network Traffic Audit

What is talking to what, and is anything suspicious reaching us?

Security groups and security lists say what could talk. Nobody can easily say what actually did. Flow logs hold the answer, but in raw form they are unreadable.

Used by CISO / Security operations · Network teams

What you see

Specific answers, not dashboards to interpret.

  • Every resource and what it talked to, with ports and volumes
  • What is exposed to the internet
  • Connections to or from known-malicious networks
  • Where traffic comes from, on a world map
CloudRuler · Network Traffic AuditSample data

Topology + traffic

What could talk, next to what actually did.

Topology shows exposure from configuration. Flow logs show whether anything used it.

Illustration: an OCI multi-VCN network map, with a hub VCN connected through a Dynamic Routing Gateway to production and non-production spoke VCNs. hub-vcn10.0.0.0/16 IGW public-sn · 10.0.1.0/24 lb-prod · listener :443cert *.example.com · 61 days left bastion-01 firewall-sn · 10.0.2.0/24 nfw-01 route table: 10.1.0.0/16 → DRG route table: 10.2.0.0/16 → DRG route table: 0.0.0.0/0 → IGW DRGhub-drg prod-vcn10.1.0.0/16 app-sn · 10.1.1.0/24 app-01 app-02 db-sn · 10.1.2.0/24 erp-db · DB system · RAC nonprod-vcn10.2.0.0/16 app-sn · 10.2.1.0/24 test-app-01 db-sn · 10.2.2.0/24 erp-test-db NAT attach attach

Illustration with sample names. Every box in CloudRuler is clickable and opens that resource’s full details.

Illustration: a resource connections graph built from flow logs. A server, app-01, sits in the centre, with lines to every peer it talked to, including ports and volumes. One inbound SSH connection from an address on a public threat blocklist is highlighted in red. app-01 10.1.1.12 lb-prod inbound :8080 · 2.1 GB erp-db outbound :1521 · 840 MB Object Storage outbound :443 · 310 MB 10.2.0.0/16 internal :8080 · 95 MB ⚠ 203.0.113.47 inbound :22 · blocklist match Internet outbound :443 · 12 MB

Illustration with sample data. Built from VCN Flow Logs. Traffic matched against public threat blocklists is highlighted.

Key capabilities

CloudRuler Network Traffic Audit

Network activity

From VCN Flow Logs: who talks to whom, on which ports, how much.

Resource connections graph

Any resource in the centre and everything it talked to around it.

Network Exposure Posture

What is open to the internet, and through which rule.

Suspicious Connections

Flows matched against public threat IP blocklists.

Geo-location

Where traffic sources are, on a world map.

Affected resources

Which of your resources a suspicious flow touched.

See CloudRuler Network Traffic Audit on your own cloud.

A 30-minute walkthrough on Oracle Cloud, AWS, or both. Bring your questions about inventory, cost or audit.