AWS Shield Advanced attack flow logs capture traffic metadata during DDoS events for detailed analysis, enabling reconstruction of attack patterns, identification of origins, and verification of mitigation behavior. Logs can be published to Amazon S3, CloudWatch Logs, or Data Firehose for integration with existing monitoring tools.