A network flow is a summarized record of communication between systems. Instead of storing every packet, flow data captures metadata such as source and destination addresses, ports, protocol, time, and volume. Common examples include NetFlow, IPFIX, and similar telemetry formats.
In cyber security, network flows matter because they let defenders see traffic patterns at scale without full packet capture. Analysts use them to build baselines, identify unusual connections, find data exfiltration paths, and spot malware beaconing or lateral movement. Flow records are also useful for operations: they can reveal bottlenecks, overloaded services, and dependencies between systems. Because flows do not show payload content, they usually support investigation rather than proving an attack on their own; teams often follow them with deeper packet, endpoint, or log analysis.