Egress and transfer records — Detection Telemetry

Collection and providers

Collect outbound flow/proxy/application transfer metadata with direction and bytes; distinguish application exports from network delivery.

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

Configuration

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Synthetic event example

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-egress-and-transfer-records",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source": "192.0.2.10",
    "destination": "198.51.100.20",
    "direction": "outbound",
    "bytes_sent": 128
  }
}

Visibility and validation

Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

• Record the lab scope, collector version, effective configuration and expected source fields before testing.
• Use an approved benign action or read-only snapshot appropriate to this type. For destructive, privileged or physical effects, use a reviewed fixture or existing authorized evidence instead of causing the effect.
• Verify the native source record locally and at the collector; compare timestamps, identity, object, action/result and the type-specific fields listed below. Save a redacted real capture separately from the synthetic example.
• Check a normal baseline and collector-loss case. Fixture parsing proves parser behavior only; it does not prove sensor coverage or malicious-behavior detection.

Primary sources

• Zeek protocol and connection logs
• Zeek capture setup
• Suricata EVE JSON output
• AWS VPC Flow Logs