[nonane]

> A better way to handle it (imo) is to just enable VPC flow logging and pull the cloudwatch stream into your SIEM

Thank you. Any recommendations for SEIM for a small company?

[Forbo]

I'd say just spin up a SecurityOnion stack. It's essentially a "SOC-in-a-box". I had a proof of concept machine spun up and generating alerts off of replayed PCAPs in a day.

[spydum]

check out managed instances like azure sentinel