WAF request logs show rule evaluation and final actions, providing decision evidence beyond CloudFront's general access response; that addresses rule-level web firewall decision evidence, rather than web request forensic evidence beyond network metadata.

Configuration assessment can flag resources that violate the required monitoring policy without sampling their live traffic; this belongs to automated verification of load-balancer logging posture, while the problem is web request forensic evidence beyond network metadata.

In the selecting the right logging layer for HTTP investigation workflow, network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; the current case needs web request forensic evidence beyond network metadata.

ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; that addresses web request forensic evidence beyond network metadata, rather than rule-level web firewall decision evidence.

Flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; this belongs to rejected flow evidence across VPC environments, while the problem is rule-level web firewall decision evidence.

WAF publishes rule-level metrics that can drive alarm thresholds without independently parsing every raw web request log; this changes quantitative monitoring of web firewall rule activity, not the necessary rule-level web firewall decision evidence.

This produces detailed managed firewall policy outcome evidence: Firewall event logs provide inspection decisions and flow state that ordinary VPC flow logs cannot fully describe; the stem instead tests rule-level web firewall decision evidence.

CloudTrail management events identify callers of AWS APIs; they are not per-DNS-query DNS Firewall matches, so they do not carry the matching domain-list and firewall action fields.

Flow Logs contain network flow addresses, ports and disposition, not the Resolver DNS Firewall rule group, domain list and rule action that matched a queried hostname.

ALB access logs describe HTTP(S) requests and target processing. They cannot attribute DNS Firewall decisions on VPC Resolver queries to the matching rule group.

Configuration history and periodic verification detect changed mirror targets or filters even when captured traffic volume seems normal; that addresses accountability for packet capture destination changes, rather than payload-level packet collection for network investigations.

CloudWatch evaluates connection-health metrics over specified periods and can notify operators of outages; this belongs to physical hybrid link failure alerting, while the problem is payload-level packet collection for network investigations.

In the rejected flow evidence across VPC environments workflow, flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; the current case needs payload-level packet collection for network investigations.

VPC Flow Logs show connection-level metadata, not VPN service negotiation diagnostics such as proposals and authentication failures.

A second state metric alarm may detect an outage sooner but cannot explain which IKE proposal or handshake stage failed.

WAF handles supported HTTP requests; it has no visibility into Site-to-Site VPN IKE/IPsec negotiations. VPN service logs, not layer-7 WAF logs, capture tunnel negotiation diagnostics.

Organization trails consolidate eligible management events across participating accounts for common security analysis; that addresses centralized administrative event collection across accounts, rather than VPN tunnel state-based incident alarms.

CloudWatch evaluates connection-health metrics over specified periods and can notify operators of outages; this belongs to physical hybrid link failure alerting, while the problem is VPN tunnel state-based incident alarms.

In the tamper-resistant multi-account network flow retention workflow, centralized log custody and controlled permissions reduce risk that workload operators can erase records of network activity; the current case needs VPN tunnel state-based incident alarms.

Flow Logs record traffic metadata, not versioned security-group configuration and Config rule compliance. AWS Config tracks resource configurations and compliance evaluations across recorders.

A central recorder does not automatically capture member-account resources in other Regions. Source recorders and aggregation are distinct.

CloudTrail captures API events and principals. It does not directly consolidate Config resource snapshots and compliance evaluations into a Config aggregator.

Firewall event logs provide inspection decisions and flow state that ordinary VPC flow logs cannot fully describe; that addresses detailed managed firewall policy outcome evidence, rather than network endpoint attribution for data movement.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; this belongs to authorized publication of VPC flow telemetry, while the problem is network endpoint attribution for data movement.

In the rejected flow evidence across VPC environments workflow, flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; the current case needs network endpoint attribution for data movement.

This produces physical hybrid link failure alerting: CloudWatch evaluates connection-health metrics over specified periods and can notify operators of outages; the stem instead tests network endpoint attribution for data movement.

Flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; this belongs to rejected flow evidence across VPC environments, while the problem is detailed managed firewall policy outcome evidence.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; this changes authorized publication of VPC flow telemetry, not the necessary detailed managed firewall policy outcome evidence.

In the network endpoint attribution for data movement workflow, aggregate bytes reveal load but not communicating endpoints; flow records provide connection-oriented metadata; the current case needs detailed managed firewall policy outcome evidence.

Centralized log custody and controlled permissions reduce risk that workload operators can erase records of network activity; this belongs to tamper-resistant multi-account network flow retention, while the problem is authorized publication of VPC flow telemetry.

Administrative deletion is a control-plane operation and appears in audit events, not inside the removed flow-log stream itself; this changes investigation of log-tampering administration events, not the necessary authorized publication of VPC flow telemetry.

In the selecting the right logging layer for HTTP investigation workflow, network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; the current case needs authorized publication of VPC flow telemetry.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; this belongs to authorized publication of VPC flow telemetry, while the problem is automated verification of load-balancer logging posture.

Network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; this changes selecting the right logging layer for HTTP investigation, not the necessary automated verification of load-balancer logging posture.

In the web request forensic evidence beyond network metadata workflow, ALB access logging contains structured HTTP request details, while complete custom header capture may require application-level instrumentation; the current case needs automated verification of load-balancer logging posture.