Vendors / Amazon Web Services / Amazon VPC / AWS VPC TCP ACCEPT and REJECT

Event type

AWS VPC TCP ACCEPT and REJECT

Default v2 inbound IPv4 TCP flow examples; registry endpoints/interface and coupled ACCEPT 443 / REJECT 3389 scenarios, coherent counters and fresh times.

PLAIN TEXT 14 fields Generator

aws vpc flow

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

14-field default v2 text profile with OK logging status. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/aws/vpc/flow.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›TCP 443 traffic is accepted.
›TCP 3389 traffic is rejected.

Security relevance

Informational

Frequency notes

One event/second test rate, five-event burst. Independent 30-second flow snapshots; no AWS delivery delay simulation.

Resources

Docs and tools

Fields and enum definitions official Complete ACCEPT/REJECT samples official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

version

String Required

Position 1 in the native text record. Fixed `2`.

Source: Fixed `2`.

Format String

Example 2

account-id

String Required

Position 2 in the native text record. Monitored interface device's `aws_account_id`; twelve decimal digits, preserving leading zeros.

Source: Monitored interface device's `aws_account_id`; twelve decimal digits, preserving leading zeros.

Format String

Example 111122223333

interface-id

String Required

Position 3 in the native text record. Same device's stable `aws_interface_id`; local eni- plus 17 lowercase hex profile.

Source: Same device's stable `aws_interface_id`; local eni- plus 17 lowercase hex profile.

Format String

Example eni-0123456789abcdef0

srcaddr

String Required

Position 4 in the native text record. Selected user's mapped client device `ip_address`.

Source: Selected user's mapped client device `ip_address`.

Format Ipv4 String

Example 10.20.0.11

dstaddr

String Required

Position 5 in the native text record. Monitored interface `ip_address`, distinct from client.

Source: Monitored interface `ip_address`, distinct from client.

Format Ipv4 String

Example 10.20.1.20

srcport

String Required

Position 6 in the native text record. Faker `pyint(49152, 65535)` through named min/max arguments; local client-port subset.

Source: Faker `pyint(49152, 65535)` through named min/max arguments; local client-port subset.

Format Integer

Example 64776

dstport

String Required

Position 7 in the native text record. Selected service `port`, 443 or 3389.

Source: Selected service `port`, 443 or 3389.

Format Integer

Example 3389

protocol

String Required

Position 8 in the native text record. Fixed IANA TCP code `6`.

Source: Fixed IANA TCP code `6`.

Format String

Example 6

packets

String Required

Position 9 in the native text record. Faker `pyint(min_value=2, max_value=30)`, selected once. Two or more packets permit the nonzero first-to-last span.

Source: Faker `pyint(min_value=2, max_value=30)`, selected once. Two or more packets permit the nonzero first-to-last span.

Format Integer

Example 14

bytes

String Required

Position 10 in the native text record. Same packet count × Faker `pyint(min_value=40, max_value=1500)`. A bounded synthetic average IP packet size; no application payload is inferred.

Source: Same packet count × Faker `pyint(min_value=40, max_value=1500)`. A bounded synthetic average IP packet size; no application payload is inferred.

Format Integer

Example 13902

start

String Required

Position 11 in the native text record. End minus 30 seconds.

Source: End minus 30 seconds.

Format Integer

Example 1790894834

end

String Required

Position 12 in the native text record. Single `now()` through `unix_timestamp` then integer truncation: Unix seconds.

Source: Single `now()` through `unix_timestamp` then integer truncation: Unix seconds.

Format Integer

Example 1790894864

action

String Required

Position 13 in the native text record. Same selected service's `vpc_action`, coupled to its port.

Source: Same selected service's `vpc_action`, coupled to its port.

Format String

Example REJECT

log-status

String Required

Position 14 in the native text record. Fixed `OK`.

Source: Fixed `OK`.

Format String

Example OK