AWS Network Load Balancer Log Monitoring

Integration Overview

AWS Network Load Balancer (NLB) operates at Layer 4 and handles high-volume TCP and TLS traffic across your AWS environment. NLB access logs capture TLS connection-level detail, providing visibility into traffic patterns, source IPs, and connection outcomes at the network edge. Panther ingests NLB access logs via S3, normalizing and storing them in a Snowflake-powered security data lake alongside the rest of your AWS telemetry for unified detection and investigation.

Use Cases for AWS NLB Logs

Common SIEM use cases for AWS NLB logs include:

• Detecting anomalous connection patterns or unexpected source IPs hitting load balancers

• Correlating NLB traffic with other AWS logs to investigate potential intrusion paths

• Monitoring TLS connection activity for compliance and network visibility requirements

Onboarding AWS NLB Logs in Panther

Panther's integration for AWS NLB is easy to configure, allowing you to onboard your log data in just a few minutes. NLB access logs are delivered to an S3 bucket and ingested into Panther using Panther's S3 data transport. Note that NLB access logs only support TLS listeners — TCP and UDP listeners do not generate access logs.

For more detailed steps on onboarding AWS NLB logs or for supported log schema, you can view our AWS NLB documentation here.