performing-cloud-log-forensics-with-athena

What problem does it solve?

Investigators and security teams can perform cloud forensics by querying AWS log data across multiple sources using AWS Athena, enabling rapid, centralized analysis of events and indicators.

Core Features & Use Cases

• Centralized forensics across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs using partitioned tables and reusable SQL queries.
• Prebuilt forensic queries and workflow steps to build evidence-grade timelines and detect unauthorized access, data exfiltration, lateral movement, and web-layer threats.
• Flexible deployment: the agent automates table creation, data discovery, and query execution in a repeatable workflow for incident response.

Quick Start

Run the forensic agent to initialize the analytics environment and start a full investigation against your AWS logs.