Powerpipe MCP Server →

Plugins Docs Home

turbot/tailpipe-mod-aws-vpc-flow-log-detections

activity_dashboard_accepted_rejected_traffic activity_dashboard_top_destination_ips_by_traffic activity_dashboard_top_enis_by_traffic activity_dashboard_top_source_destination_pairs_by_packets activity_dashboard_top_source_ips_by_rejected_traffic activity_dashboard_top_source_ips_by_traffic activity_dashboard_total_accepted_traffic activity_dashboard_total_records activity_dashboard_total_rejected_traffic activity_dashboard_traffic_by_log_status activity_dashboard_traffic_by_protocol activity_dashboard_traffic_by_region database_traffic high_packet_traffic large_data_transfer rdp_traffic ssh_traffic traffic_with_unusual_protocols

Query: Top 10 Destination IP Addresses by Traffic

Description

List the top 10 destination IP addresses generating the most traffic.

Usage

powerpipe query aws_vpc_flow_log_detections.query.activity_dashboard_top_destination_ips_by_traffic

Tailpipe Tables

aws_vpc_flow_log

AWS plugin

Tags

SQL

select
  dst_addr as "Destination IP",
  count(*) as "Records",
  coalesce(sum(bytes), 0) as "Total Bytes",
  coalesce(sum(packets), 0) as "Total Packets",
  max(start_time) as "Last Seen"
from
  aws_vpc_flow_log
where
  dst_addr is not null
group by
  dst_addr
order by
  "Records" desc
limit 10;

Dashboards

The query is used in the dashboards:

VPC Flow Log Activity Dashboard