# AWS242 Network Evidence Correlation Workbook

## Safety and evidence identity

- Case:
- Account/Region reference:
- UTC incident/query interval:
- Expected tuple/path:
- Telemetry created before incident: Yes / No / Unknown
- Production changed: No

## Telemetry coverage

| Evidence | Resource/scope | Traffic/filter/tuple | Time/retention | Delivery/status | Blind spot |
|---|---|---|---|---|---|
| Flow Logs | | | | | |
| Reachability Analyzer | | | | | |
| Network Access Analyzer | | | | | |
| Network monitoring | | | | | |
| Application/OS | | | | | |

## Flow record interpretation

| Field | Observed | Interpretation |
|---|---|---|
| Interface/direction | | |
| Source/destination | | |
| Packet source/destination | | |
| Ports/protocol | | |
| Packets/bytes | | |
| Start/end | | |
| Action | | |
| TCP flags | | |
| Log status | | |

- What `ACCEPT/REJECT` proves:
- What it does not prove:
- Missing reverse record explanation:
- Delay/aggregation/coverage uncertainty:

## Reachability Analyzer

- Source/destination/protocol/port:
- Required/excluded intermediate:
- Analysis time and configuration time:
- Result and first explanation:
- Alternative/additional blocker possibility:
- Unsupported/transient/application behavior not modeled:

## Network Access Analyzer

- Security requirement:
- MatchPaths:
- ExcludePaths:
- Exclusion owner/reason/expiry:
- Analysis account/Region/time:
- Finding/no-finding interpretation:
- Unsupported scope:

## Performance monitoring

- Choose: Network Flow / Internet / Network Synthetic Monitor
- Why:
- Metric/event:
- Baseline/threshold:
- Attribution confidence:
- Application SLI correlation:

## Conclusion

- Evidence that agrees:
- Evidence that conflicts:
- First failed layer/root cause:
- Unknowns:
- Correction and owner:
- Rollback:
- Layer and end-to-end retest:
- Prevention:

## Cost, retention, and closeout

- Ingestion/delivery/storage/query:
- Analysis:
- Monitor/probe/metrics:
- Retention/deletion owner:
- Pricing date/Region:
- Before/after inventory:
- Changes made: None