Log analysis

Exam tasks: 1.2 (skills 1.2.4 and 1.2.5: analyze logs, normalize, parse and correlate them)

The decision: where do the logs already live, how far back and how fast must you search, and do you need ad hoc queries, SQL over years of data, or live search and dashboards?

Picking the query engineCopy Anchor Link

CloudWatch Logs InsightsCopy Anchor Link

fields @timestamp, userIdentity.arn, sourceIPAddress, errorCode
| filter eventSource = "s3.amazonaws.com" and errorCode = "AccessDenied"
| stats count(*) as denials by userIdentity.arn, sourceIPAddress
| sort denials desc
| limit 20

• Discovers fields automatically for JSON logs and AWS logs such as CloudTrail, VPC flow logs, Route 53 and Lambda.
• Three languages: Logs Insights QL (above), OpenSearch PPL and OpenSearch SQL, which can join across log groups.
• Queries time out after 60 minutes and results are kept for 7 days. Save queries, add them to dashboards, and encrypt results with KMS.
• Field indexes cut the data scanned on large log groups. Pattern analysis groups similar lines, and comparison queries show what changed against an earlier period.
• In a cross-account observability monitoring account, one query can span log groups in linked source accounts.
• It can't see events older than the log group, and it's not built for multi-year history. Keep that in S3.

Athena over S3Copy Anchor Link

• Point Athena at the trail bucket (or flow log, ALB, WAF bucket) with a table definition. Use partition projection on Region, account and date so queries skip irrelevant prefixes instead of relying on crawlers or adding partitions by hand.
• Always filter on the partition columns. A query without a date filter scans the whole bucket and costs accordingly.
• Use workgroups to enforce an encrypted results location, per-query data limits and who can run what.
• Readers need s3:GetObject on the logs, kms:Decrypt on the log key, and write access to the results bucket. In an organization this is usually a read-only investigator role in the log archive account.

SELECT eventtime, eventname, sourceipaddress, awsregion
FROM org_trail
WHERE useridentity.accesskeyid = 'AKIAEXAMPLEKEY123'
  AND day BETWEEN '2025/03/01' AND '2026/08/31'
ORDER BY eventtime;

OpenSearch Service with Amazon Data FirehoseCopy Anchor Link

• A subscription filter streams matching log events from a log group to Firehose, Kinesis Data Streams, Lambda or OpenSearch. Cross-account delivery goes through a CloudWatch Logs destination in the receiving account.
• Firehose buffers by size and time (up to 900 seconds), can call a Lambda function to parse, enrich or reformat records, and backs up records that fail delivery to S3.
• CloudWatch Logs delivers to subscribers gzip-compressed and base64-encoded, so the transform must decompress before OpenSearch can index it.
• Firehose can deliver to a domain inside a VPC. Its IAM role needs es:ESHttp* on the domain, and with fine-grained access control the role must also be mapped to an OpenSearch backend role.
• OpenSearch Ingestion is the managed pipeline alternative when you need more processing than a Lambda transform. Security Analytics in OpenSearch applies detection rules (Sigma format) to indexed logs.

Normalizing and correlatingCopy Anchor Link

• OCSF gives every source the same field names (actor, src_endpoint, api.operation), so one query covers CloudTrail, flow logs and a partner firewall. Security Lake does this conversion for supported AWS sources.
• For custom sources, convert to OCSF Parquet yourself, typically in a Lambda function or a Glue job, before writing to the Security Lake custom source location.
• CloudWatch Logs transformers parse and reshape events at ingestion, including processors that map supported AWS logs to OCSF, so metric filters and queries see structured fields.
• Lambda is the glue for enrichment: add account names from Organizations, geolocate IPs, tag findings.
• For visual correlation across sources and accounts, chart the results in Managed Grafana. See Alerting and dashboards.

Querying Security LakeCopy Anchor Link

• Each source becomes a Glue table in the Security Lake database for its Region, for example the CloudTrail management, VPC flow and Route 53 tables. Query the rollup Region to see all contributing Regions.
• Query access subscribers get Lake Formation grants (shared through resource links) and query with Athena or another Lake Formation-aware engine in their own account. Nothing is copied.
• Data access subscribers are notified of new objects (through SQS or an HTTPS endpoint) and read the Parquet files directly, which suits a third-party SIEM that ingests data.
• Permissions are managed in Lake Formation. A cross-account S3 bucket policy on the lake bucket bypasses the governance model and is the wrong answer.

ScenariosCopy Anchor Link

Further readingCopy Anchor Link

• Analyzing log data with CloudWatch Logs Insights
• Querying AWS CloudTrail logs with Athena
• Real-time processing of log data with subscriptions
• Managing subscribers in Security Lake