performing-cloud-log-forensics-with-athena - Perform Cloud Log Forensics with AWS Athena
Queries CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs with Athena to investigate unauthorized access, data exfiltration, lateral movement, and privilege escalation.
Tags
Updated: 2026-09-29cloud securitydigital forensicsAWS AthenaCloudTrailVPC Flow LogsS3 access logsALB logsincident response
Capabilities
Typical Inputs
What this skill does
- Create forensic Athena tables
- Configure partition projection
- Query CloudTrail events
- Analyze VPC flow logs
- Analyze S3 access logs
- Analyze ALB access logs
- Detect unauthorized API calls
- Detect privilege escalation attempts
Inputs
- CloudTrail logs
- VPC Flow Logs
- S3 access logs
- ALB access logs
- S3 bucket locations
- AWS account identifiers
- AWS region values
- Investigation date ranges
Outputs
- Athena forensic database
- Athena external tables
- Forensic query results
- Security investigation findings
Requirements
- AWS account
- Athena permissions
- S3 permissions
- Glue permissions
- CloudTrail delivery to S3
- VPC Flow Logs enabled
- S3 server access logging enabled
- ALB access logging enabled
- Python 3.8+
- boto3 installed
- IAM query permissions
