AWS Security Lake Tutorial Demonstrates Athena Queries and OpenSearch Dashboards

Summary

The presenter demonstrates how AWS Security Lake collects OCSF-formatted logs, then uses Athena for investigation and OpenSearch for direct querying and dashboards to support security monitoring, threat hunting, and incident response.

Key points

• The presenter explains that security monitoring must process logs from varied endpoints, servers, applications, databases, and network devices, often requiring ETL to normalize data for analysis.
• Amazon Security Lake can ingest AWS telemetry and custom sources, storing the logs in S3 in OCSF format.
• The demonstration covers configuring data sources, regions, and subscribers, with S3 or Lake Formation access methods for controlled access across accounts.
• Athena queries can inspect Security Lake data; the presenter demonstrates filtering web application firewall records to investigate an unspecified IP address and request activity.
• OpenSearch can connect to Security Lake for direct queries and visualizations; the walkthrough covers setting up permissions and a role.
• CloudTrail and web application firewall dashboards show event trends and filters that can support monitoring, threat hunting, investigation, and incident response.

Vendors

Products

Related Articles

• Exabeam Adds AI-Assisted Security Investigations and On-Premises Agentic SOC Featureshelpnetsecurity.comOpenSearch
• Huntress Details Athena, Its AI-Assisted SOC Investigation Systemhuntress.comAthena
• AWS August 2026 Security Digest Covers 23 Bulletins and Agentic AI Securityaws.amazon.comOpenSearch
• Huntress Details Athena AI SOC, New Investigation View and Security Integrationshuntress.comAthena
• Huntress Urges Australian Boards to Prioritize Cyber Resilience and Human Oversight of AIhuntress.comAthena