Cloud Service & Region Enrichment
NFO automatically identifies public cloud traffic by matching flow IP addresses against a built-in lookup table of known cloud provider IP ranges. No credentials, cloud account, or additional configuration is required — this enrichment is active for all flows from the moment NFO is running.
Enriched Fields
For every flow where the source or destination IP matches a known cloud provider range, NFO appends the following fields:
| Field | Description | Example |
|---|---|---|
src_cloud_service | Cloud service associated with the source IP | EC2, AzureAppService, GoogleCloud |
dest_cloud_service | Cloud service associated with the destination IP | S3, AzureStorage, OCI |
src_cloud_region | Cloud region of the source IP | us-east-1, eastus, europe-west1 |
dest_cloud_region | Cloud region of the destination IP | eu-west-1, ap-southeast-2, uk-south |
Fields are only populated when a match is found. Traffic to non-cloud IPs will not have these fields set.
Coverage
The lookup table covers the following cloud providers:
| Provider | Source |
|---|---|
| AWS | Published IP ranges covering services such as EC2, S3, CloudFront, Lambda, and many others |
| Microsoft Azure | Published IP ranges covering services such as AzureAppService, AzureStorage, AzureAD, and many others |
| Google Cloud | Published IP ranges |
| Oracle Cloud (OCI) | Published IP ranges |
NFO updates the lookup table automatically as cloud providers publish new IP ranges.
How It Differs from Cloud-Specific Enrichment
| Service & Region | Cloud-Specific (AWS, Azure, GCP, OCI) | |
|---|---|---|
| Requires cloud credentials | No | Yes (via ingestion config) |
| Works for on-premises traffic | Yes | No — only for cloud-ingested flows |
| Fields provided | Provider, service, region | Instance names, VPC/VNet IDs, tags |
| Configuration needed | None | Cloud flow log ingestion |
Use this enrichment as a baseline for all deployments. Add cloud-specific ingestion for resource-level visibility where needed.
Reference
The IP range lookup is based on the published IP range datasets from each cloud provider: