Corelight Flow Log Sensor is a network security monitoring solution that processes raw flow logs from various sources including AWS, NetFlow, and other native flow formats. The sensor normalizes and correlates flow data into standardized Zeek logs with security-focused metadata. The product ingests flow logs from devices or storage locations such as AWS S3 buckets. It combines unidirectional flow data from communicating hosts to provide visibility of network activity. The sensor performs data deduplication and normalization to reduce redundant information while maintaining security-relevant details. The solution provides coverage across VPCs, containers, functions, and traditional network environments. It generates structured logs that can be exported to SIEM platforms, data lakes, or analytics tools. The normalized output is designed to support threat detection workflows including identification of suspicious connections, lateral movement, and command and control activity. The sensor addresses use cases in incident response by enabling analysts to trace attacker activity across accounts, workloads, and networks. It supports compliance and governance requirements through enriched traffic records. The data processing approach reduces storage and ingestion costs associated with raw flow log volumes. The product operates in cloud, hybrid, and on-premises environments. It processes flow data to deliver what the vendor describes as high-fidelity network evidence in a standardized format.