Do you have any other resources to point me toward describing how you would set something like this up in a cloud environment? Are there other tools better suited for cloud environments?
I think AWS's VPC Flow Logs are the foundation for better tools (disclaimer, my company develops these tools - [2]). I hope Azure and others follow suit.
[1] https://www.sans.org/reading-room/whitepapers/cloud/security...
[2] https://observable.net/blog/vpc-flow-logs-virtual-private-cl...