This content is open to everyone — sign in to save your progress, earn points, and unlock module exams.

Cloud Forensics and Incident Investigation

Topic 6.6 of Cloud Forensics and Incident Investigation

Cloud Forensic Tools: Athena, OpenSearch & Splunk

Amazon Athena for SQL-based CloudTrail forensics, OpenSearch for real-time investigation, Splunk for enterprise SOC environments, and comparison across forensic use cases.

~35 min total·4 quadrants of structured content

By the end of this topic, you will

Set up an Athena external table for CloudTrail logs with partition projection
Write four forensic Athena SQL queries — compromised key, S3 exfiltration, new IAM users, cross-account AssumeRole
Compare Athena, OpenSearch, and Splunk for historical vs real-time forensic investigation
Explain how Splunk SPL detects a CloudTrail disable-then-reenable pattern

Quadrant 1 · e-Tutorial

Video lectures and walkthroughs

Quadrant 2 · e-Content

Articles and case studies

cloud-security

Cloud Forensic Tools: Amazon Athena, Splunk & OpenSearch Investigations

Cloud-scale forensics requires tools capable of querying billions of log events in minutes. Amazon Athena, Splunk, and OpenSearch each provide this capability with different trade-offs. This article covers practical query patterns for forensic investigation.

20 min read

Quadrant 3 · Web Resources