3.2.2. Searching and Correlating Logs for Events
First Principle: A single log source tells you part of the story; correlated logs across sources tell you the complete story. Effective investigation requires combining identity logs (CloudTrail), network logs (Flow Logs), DNS logs (Resolver), and application logs to reconstruct the full attack timeline.
Investigation Workflow:
- Start with the initial finding — What triggered the alert? (GuardDuty finding, Security Hub alert, CloudWatch alarm)
- Pivot on identity — Who is the actor? (IAM user, role, access key, IP address)
- Expand temporally — What else did this actor do before and after the detected event?
- Expand across services — Did the actor access S3? Create IAM resources? Launch instances?
- Correlate network data — What network connections correspond to the API activity?
- Build the timeline — Arrange all events chronologically to reconstruct the attack narrative
Query Examples by Log Source:
| Investigation Question | Log Source | Query Approach |
|---|---|---|
| What API calls did the attacker make? | CloudTrail | Filter by access key ID or source IP |
| What network connections did the instance make? | VPC Flow Logs | Filter by instance ENI |
| What DNS lookups occurred? | Route 53 Resolver | Filter by VPC and time window |
| What data was accessed in S3? | CloudTrail data events | Filter by bucket name and eventName |
| What findings exist for this resource? | Security Hub | Filter by resource ARN |
⚠️ Exam Trap: CloudTrail records WHO made API calls. VPC Flow Logs record WHAT network traffic occurred. They answer different questions. A question asking "what data did the attacker exfiltrate from S3" requires CloudTrail data events (not Flow Logs).
Scenario: A compromised access key was used from an unusual IP. You query CloudTrail filtered by the key ID and discover the attacker: listed S3 buckets, downloaded objects from a PII bucket, created a new IAM user, and attached AdministratorAccess. You correlate with VPC Flow Logs to confirm data transfer volume.
Reflection Question: Why does effective log correlation require starting with a pivot point (identity, IP, or resource) rather than searching all logs simultaneously?
