flow logs
termcloudsecurity
The cloud's NetFlow: records of accepted and rejected connections per interface, subnet, or VPC - who talked to whom, and who was refused.
The first evidence pulled in cloud incident response; REJECT lines are free reconnaissance detection.