activity_dashboard_accepted_rejected_trafficactivity_dashboard_top_destination_ips_by_trafficactivity_dashboard_top_enis_by_trafficactivity_dashboard_top_source_destination_pairs_by_packetsactivity_dashboard_top_source_ips_by_rejected_trafficactivity_dashboard_top_source_ips_by_trafficactivity_dashboard_total_accepted_trafficactivity_dashboard_total_recordsactivity_dashboard_total_rejected_trafficactivity_dashboard_traffic_by_log_statusactivity_dashboard_traffic_by_protocolactivity_dashboard_traffic_by_regiondatabase_traffichigh_packet_trafficlarge_data_transferrdp_trafficssh_traffictraffic_with_unusual_protocols
Query: Accepted vs. Rejected Traffic
Description
Comparison of accepted and rejected record counts.
Usage
powerpipe query aws_vpc_flow_log_detections.query.activity_dashboard_accepted_rejected_trafficTailpipe Tables
Tags
SQL
with time_series as ( select date_trunc('day', start_time) as day, count(*) filter (where action = 'ACCEPT') as accepted, count(*) filter (where action = 'REJECT') as rejected from aws_vpc_flow_log group by day order by day)select day, accepted, rejectedfrom time_seriesorder by day;
Dashboards
The query is used in the dashboards: