# VPC Flow Logs

Amazon VPC feature for capturing IP traffic information to and from VPC network interfaces as flow log records.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation

DevFeed: [Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation](<https://devfeed.tech/articles/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation-4678.md>)

Original publisher: [Read original article](<https://aws.amazon.com/blogs/security/detecting-multi-stage-attacks-on-aws-a-guide-to-cross-service-signal-correlation/>)

Author: Nisha Kashyap

Published: 2026-08-26T17:39:19Z

Content type: article

Language: en

Sources: [AWS Security Blog](<https://devfeed.tech/sources/aws-security-blog.md>)

Topics: [Amazon Web Services (AWS)](<https://devfeed.tech/topics/amazon-web-services-aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [Detection engineering](<https://devfeed.tech/topics/detection-engineering.md>), [Amazon CloudWatch Logs](<https://devfeed.tech/topics/amazon-cloudwatch-logs.md>), [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [VPC Flow Logs](<https://devfeed.tech/topics/vpc-flow-logs.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [advanced-300](<https://devfeed.tech/tags/advanced-300.md>), [amazon-cloudwatch](<https://devfeed.tech/tags/amazon-cloudwatch.md>), [amazon-cloudwatch-logs](<https://devfeed.tech/tags/amazon-cloudwatch-logs.md>), [amazon-guardduty](<https://devfeed.tech/tags/amazon-guardduty.md>), [amazon-route-53](<https://devfeed.tech/tags/amazon-route-53.md>), [amazon-web-services-aws](<https://devfeed.tech/tags/amazon-web-services-aws.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [aws-security-hub](<https://devfeed.tech/tags/aws-security-hub.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [guide](<https://devfeed.tech/tags/guide.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [logs](<https://devfeed.tech/tags/logs.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security](<https://devfeed.tech/tags/security.md>), [security-blog](<https://devfeed.tech/tags/security-blog.md>), [security-identity-compliance](<https://devfeed.tech/tags/security-identity-compliance.md>), [shared-responsibility-model](<https://devfeed.tech/tags/shared-responsibility-model.md>), [technical-how-to](<https://devfeed.tech/tags/technical-how-to.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>), [vpc-flow-logs](<https://devfeed.tech/tags/vpc-flow-logs.md>)

### AI overview

This article explains how security engineers can detect multi-stage attacks on AWS by correlating signals across services with business context. It presents examples using CloudWatch Logs Insights and discusses expanding the correlations into an automated pipeline.

### Source excerpt

A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack. Consider a short sequence. An identity calls GetCallerIdentity from a source address it hasn't previously used. Within minutes, [...]

## Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs

DevFeed: [Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs](<https://devfeed.tech/articles/automate-aws-athena-partitions-for-organization-cloudtrail-logs-and-vpc-flow-logs-23687.md>)

Original publisher: [Read original article](<https://medium.com/betclic-tech/automate-aws-athena-partitions-for-organization-cloudtrail-logs-and-vpc-flow-logs-2f322291c897?source=rss----7e406d68d94b---4>)

Author: Aurelien Cerveaux

Published: 2022-09-15T06:39:58Z

Content type: tutorial

Language: en

Sources: [betclic-tech - Medium](<https://devfeed.tech/sources/betclic-tech-medium.md>)

Topics: [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [VPC Flow Logs](<https://devfeed.tech/topics/vpc-flow-logs.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [AWS CloudFormation](<https://devfeed.tech/topics/aws-cloudformation.md>), [DynamoDB](<https://devfeed.tech/topics/dynamodb.md>), [JSON](<https://devfeed.tech/topics/json.md>)

Tags: [amazon-s3](<https://devfeed.tech/tags/amazon-s3.md>), [athena](<https://devfeed.tech/tags/athena.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cloudformation](<https://devfeed.tech/tags/cloudformation.md>), [cloudtrail](<https://devfeed.tech/tags/cloudtrail.md>), [dynamodb](<https://devfeed.tech/tags/dynamodb.md>), [events](<https://devfeed.tech/tags/events.md>), [json](<https://devfeed.tech/tags/json.md>), [vpc-flow-logs](<https://devfeed.tech/tags/vpc-flow-logs.md>)

### AI overview

A tutorial explains how to automate daily AWS Athena partition creation for organization-level CloudTrail and VPC Flow Logs. It describes using Amazon S3, AWS Glue Data Catalog, CloudFormation, SAM, Lambda, DynamoDB, and EventBridge to improve query efficiency and reduce scanned data and cost.

### Source excerpt

This article's goal is to explain how to query efficiently, and at low cost with AWS Athena, AWS CloudTrail logs, or VPC Flow logs by automating the creation of Athena partitions daily. AWS CloudTrail AWS CloudTrail is a service that records all API Calls and Events for AWS Accounts, including details on calls made to your AWS Services and the Console as well. Activated at the Organization level, CloudTrail logs help you in several cases: Simplified Compliance Summarizing Accesses Security Analysis and Troubleshooting Monitoring Users and Resources Activities Governance and Investigation CloudTrail Logs are delivered in an S3 Bucket in JSON format through many small files that make these difficult to operate and request. VPC Flow Logs VPC Flow Logs is a feature that allows you to capture traffic information going to and from your network interfaces in your VPC. It helps you to: Analyze and troubleshoot network issues Determine the direction of your traffic Monitor the traffic Like CloudTrail Logs, Flow Logs are published in an S3 Bucket for all accounts in the Organization. AWS Athena AWS Athena is a query service that permits you to analyze data directly in an Amazon S3. You can create tables in Athena which use AWS Glue Data Catalog and are based on an S3 location. To query efficiently and with less scanned data and optimize the cost, we need to create some partitions. To know more about Tables, Databases, and Catalog in Athena. Automate Partitions Creation In our case, we are using CloudTrail Logs and VPC Flow Logs to detail the solution and the source code. All is done in CloudFormation and using SAM to deploy the Lambda. Global Overview We have several parts to automate the creation of our partitions. A common part containing: The Lambda is used to create partitions concerning different log types A DynamoDB table used to store partition names A specific part for each log type contains: The Glue Table with the proper structure An EventBridge Rule to trigger the