# 使用Security Lake和Athena分析日志

如果需要查看AWS CloudTrail 事件历史记录，推荐选择使用Amazon Security Lake统一收集并用Athena查询。（好处是开启Amazon Security Lake以后<mark style="color:purple;">直接就可以使用Athena查询</mark>比如CloudTrail日志了，不需要再配置Athena创建数据库和表以及也不需要做字段拆分。非常方便）具体可以查看[使用Security Lake收集安全日志](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/ri-zhi-ji-zhong-guan-li/shi-yong-amazon-security-lake-shou-ji-an-quan-ri-zhi)，以及[使用Athena分析日志](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/4.-ri-zhi-yu-jian-kong/ri-zhi-ji-zhong-guan-li/shi-yong-athena-fen-xi-ri-zhi)。使用AWS Security Lake统一收集并用Athena查询会比使用CloudTrail Lake进行日志的分析要便宜，两者的对比可以[参见此文档](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/an-quan-chan-pin-cheng-ben-gu-suan/amazon-security-lake-he-aws-cloudtrail-lake-zuo-ri-zhi-fen-xi-de-cheng-ben-dui-bi)。

<mark style="color:orange;">如果之前使用CloudTrail+Athena查询，切换到Security Lake保存日志后可以通过：</mark>

<mark style="color:orange;">github-</mark>[<mark style="color:orange;">https://github.com/ocsf/examples/tree/main/Identity%20%26%20Access%20Management/Account%20Change/AWS/CloudTrail</mark>](https://github.com/ocsf/examples/tree/main/Identity%20%26%20Access%20Management/Account%20Change/AWS/CloudTrail)

<mark style="color:orange;">检索字段的映射关系进行替换。</mark>

## 安装Security Lake

[https://docs.aws.amazon.com/security-lake/latest/userguide/getting-started.html?icmpid=docs\_security-lake\_help\_panel <br>](https://docs.aws.amazon.com/security-lake/latest/userguide/getting-started.html?icmpid=docs_security-lake_help_panel)

### 1 - 点击 Get started

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FPSV8KmFNzVNYkAFz4dTy%2Fimage.png?alt=media&#x26;token=8a3a9232-19df-45a1-974e-51a0b35a4e0b" alt=""><figcaption></figcaption></figure>

### 2 - 定义收集的对象

可以选择收集所有类型的日志，也可以指定想要收集的日志类型。

推荐选择所有的：

![](https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FpwAevaqKaPvwr08EVe7L%2FScreenshot%202023-09-27%20at%2010.22.17.png?alt=media\&token=2ab3a6a4-3ca6-4aa1-a72e-c3a8299654c9)![](https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FddyDmwhtvMoxcxtmBUkU%2FScreenshot%202023-09-27%20at%2010.22.33.png?alt=media\&token=0f3e2480-94ec-4224-a96b-cfc90118b0c4)

可以选择所有区域的日志，也可以指定想要收集的区域。

推荐选择所有的：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FrObz70WftSw3vgnitEgI%2FScreenshot%202023-09-27%20at%2010.22.54.png?alt=media&#x26;token=6835104c-ab59-40f0-a1f5-567f5fda1cf2" alt=""><figcaption></figcaption></figure>

之后选择集中存储日志的区域，比如Rollup Region都设置为US East(Ohio)，被汇总的区域写在Contributing Region中：

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FaL5sSD6MopJCFiaIgsSS%2FScreenshot%202023-09-27%20at%2010.23.20.png?alt=media&#x26;token=8819e87d-e756-4627-919b-13d901d68ea3" alt=""><figcaption></figcaption></figure>

之后配置S3存储桶的生命周期策略，比如30天后保存到Standard-IA，180天后保存到Glacier Deep Archive。点击Enable就配置完成了。

![](https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FdmpXT7kXK6sZKqGiUfvj%2FScreenshot%202023-09-27%20at%2010.24.11.png?alt=media\&token=081fe8ab-080d-4b2d-9846-2b5f7e2f03c7)![](https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FKdLYYcfhfadMYjyX2KbP%2FScreenshot%202023-09-27%20at%2010.24.33.png?alt=media\&token=2c2c4e8b-ecfd-4e8c-93e3-0d1ac38e5b7f)

## 访问Athena查询日志进行分析

<figure><img src="https://3752289132-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LTfg4e0NhLEbwi6WFJp%2Fuploads%2FGGIwjSi7MDNsXUYG0DvF%2FScreenshot%202023-09-27%20at%2012.17.15.png?alt=media&#x26;token=479a2c00-a492-4f60-9bcf-793e91eab9ca" alt=""><figcaption></figcaption></figure>

## 参考资料

\[Github] [Amazon Security Lake Example Queries](https://github.com/awslabs/aws-security-analytics-bootstrap/blob/main/AWSSecurityAnalyticsBootstrap/amazon_security_lake_queries/ocsf/amazon_security_lake_queries_all.md#amazon-security-lake-example-queries)

\[Github] [cloudtrail\_demo\_queries](https://github.com/awslabs/aws-security-analytics-bootstrap/blob/main/AWSSecurityAnalyticsBootstrap/sql/dml/analytics/cloudtrail/cloudtrail_demo_queries.sql)

[\[Guide\] The Athena Guide](https://the.athena.guide/)
