Network flow telemetry is a record of who talked to whom on a network, when, for how long, and how much data moved. It usually captures metadata such as source and destination IP addresses, ports, protocol, byte counts, and session timing rather than the full packet contents. Because it is lightweight, organizations can keep it for longer periods and search it quickly during an investigation.
In cyber security, flow data helps analysts spot suspicious outbound connections, hidden command-and-control traffic, and possible data exfiltration. A server that suddenly sends large transfers to an unfamiliar cloud host, or makes repeated small beaconing connections, can stand out in flow records even when application logs are sparse. Defenders use it alongside DNS, proxy, and endpoint logs to reconstruct activity, confirm containment, and distinguish normal business traffic from a leak in progress.