Athena Incident Response Expert-Athena SQL Query Generation

Example

SELECT * FROM cloudtrail_logs WHERE eventName = 'ConsoleLogin' AND errorcode = 'AccessDenied'

Scenario

When suspicious failed login attempts need investigation, this function helps identify potential unauthorized access attempts.

Example

SELECT useridentity.arn, eventname FROM cloudtrail_logs WHERE eventtime BETWEEN '2023-01-01' AND '2023-01-31'

Scenario

For organizations needing to audit user activities for compliance with regulatory standards, this function allows them to extract specific actions performed within a given timeframe.

Example

SELECT eventTime, eventName, awsRegion FROM cloudtrail_logs WHERE resources -> 'ARN' LIKE '%instance-id%'

Scenario

Useful for tracking how specific AWS resources are being utilized and monitoring for any unusual activity that might indicate a compromise.

Example

SELECT eventName, COUNT(*) FROM cloudtrail_logs WHERE errorcode IS NOT NULL GROUP BY eventName

Scenario

This function helps identify the most frequent errors or denied actions, indicating potential misconfigurations or attempts to access unauthorized resources.