Serverless Log Analysis On AWS
In this talk we will go over traditional log analysis methods for AWS Cloudtrail logs and why we needed to find a better way of performing such investigations. We will then dive into AWS Athena which is essentially a ...
Summary
### Scalable Serverless Log Triage on AWS At 00:00, Georgios Kapoglis (Incident Responder at Verizon Media) presents an architecture for serverless log aggregation and threat detection across enterprise AWS cloud environments.
### Ingestion of Multi-Account Cloud Telemetry At 06:01, Kapoglis explains how centralized logging pipelines aggregate AWS CloudTrail events, VPC Flow Logs, and CloudWatch metrics from hundreds of AWS accounts into a centralized Amazon S3 security bucket.
### Cost-Effective Querying with Amazon Athena At 12:01, the speaker details the economics of serverless threat hunting using Amazon Athena. Running Presto-based SQL queries directly against compressed S3 logs costs only $5 per terabyte scanned, eliminating the massive server maintenance overhead of traditional dedicated SIEM clusters.
### Templated SQL Threat Hunting Queries At 18:00, the presentation showcases pre-authored SQL hunting queries. Frontline analysts can execute templated queries to detect IAM privilege escalation, abnormal cross-region API usage, and unauthorized modifications to S3 bucket access control policies.
### Columnar Optimization with Parquet and Glue Concluding between 24:00 and 30:01, Kapoglis demonstrates performance tuning using AWS Glue ETL crawlers to convert raw JSON logs into columnar Apache Parquet format. This reduces data scan volumes by 80-90%, drastically cuts query latency, and feeds automated alerts into AWS Lambda for rapid incident containment.
(AI summary — Gemini Flash)
Related talks
Blue Team Village·44 min
Carlos Garay
Memhunter is an endpoint sensor tool specialized in detecting memory-resident malware. The detection process is performed through a combination of endpoint data collection and memory inspection scanners. Memhunter au...
Blue Team Village·26 min
ch33r10
What if I told you that it is possible for blue teamers to practice CTI everyday?! With minimal guidance and insight, blue teamers can learn how to see things through the eyes of a cyber threat intel analyst. We’ll st...
Blue Team Village·29 min
Anton Ovrutsky
Anton Ovrutsky demonstrates behavioral detection patterns, static parsing tools, and deobfuscation methods to hunt malicious Office VBA macros.