performing-cloud-log-forensics-with-athena

Name: performing-cloud-log-forensics-with-athena
Availability: InStock
Author: YukiIto1999

Query AWS CloudTrail, VPC Flow, S3, and ALB logs with Athena.

Updated Apr 23, 2026

Search Tags:#aws #forensics #athena #cloudtrail #vpc-flow-logs #alb-logs

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-log-forensics-with-athena

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: performing-cloud-log-forensics-with-athena
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-cloud-log-forensics-with-athena
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-log-forensics-with-athena

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, botocore, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Investigators and security teams can perform cloud forensics by querying AWS log data across multiple sources using AWS Athena, enabling rapid, centralized analysis of events and indicators.

Core Features & Use Cases

Centralized forensics across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs using partitioned tables and reusable SQL queries.
Prebuilt forensic queries and workflow steps to build evidence-grade timelines and detect unauthorized access, data exfiltration, lateral movement, and web-layer threats.
Flexible deployment: the agent automates table creation, data discovery, and query execution in a repeatable workflow for incident response.

Quick Start

Run the forensic agent to initialize the analytics environment and start a full investigation against your AWS logs.

Frequently Asked Questions about performing-cloud-log-forensics-with-athena

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I query AWS CloudTrail and VPC Flow Logs for forensic investigations?▼

You can query CloudTrail and VPC Flow Logs for forensic investigations by using Athena to run centralized SQL queries across multiple accounts and regions. This approach leverages partitioned tables and prebuilt SQL templates to rapidly detect unauthorized access and build evidence-grade timelines.

What is the best way to analyze ALB logs and S3 access logs for unauthorized access?▼

Analyzing ALB logs and S3 access logs for unauthorized access is best done using Athena with partitioned tables. Prebuilt forensic queries and workflows automate table creation and data discovery, enabling rapid detection of web-layer threats and data exfiltration.

Do I need boto3 and Python to run Athena queries for cloud log forensics?▼

Yes, you need Python 3.8+ with boto3 to run the agent for cloud log forensics with Athena. The agent automates table creation, loads metadata, and executes forensic queries, requiring an AWS account with Athena, S3, and Glue permissions.

How does Athena handle centralized log forensics across multiple AWS accounts and regions?▼

Athena handles centralized log forensics across multiple AWS accounts and regions by using partitioned tables to organize log data from CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs. This enables rapid, centralized analysis of events and indicators.

Can I detect lateral movement and data exfiltration using Athena SQL templates?▼

Yes, you can detect lateral movement and data exfiltration using Athena SQL templates. The prebuilt forensic queries analyze AWS logs like CloudTrail and VPC Flow Logs to identify unauthorized access and build evidence-grade timelines for incident response.

What AWS permissions are required to set up partitioned tables for cloud log analysis?▼

Setting up partitioned tables for cloud log analysis requires an AWS account with Athena, S3, and Glue permissions. These permissions allow the agent to automate table creation, load metadata, and execute forensic queries across your log data.