Flow logs are records that summarize network connections, typically noting source and destination addresses, ports, protocol, traffic volume, and timing. Unlike packet captures, they generally do not record the full contents of network communications.
During an incident, defenders use flow logs to identify unusual traffic patterns, trace communication between endpoints, and assess when and where a surge occurred. In a suspected DDoS attack, they can help show traffic volume and direction, but summaries alone may not reveal the exact attack method or who controlled the sending systems. Investigators combine flow logs with other telemetry and treat observed network origins as clues, not proof of attribution.