Cloud Security

Say you run a security operations center and you want an AI copilot to help triage network traffic. The raw material is sitting right there: AWS VPC Flow Logs, a line per network connection, millions of them a day. Pasting them into a hosted large language model (an LLM, the kind of model behind Claude or ChatGPT) feels like it should just work. The problem is what a flow log line actually contains: your internal IP layout, your AWS account number, the identifiers of your network cards. Hand that to a third-party service and you have shipped a map of your private network to someone else’s computer, where it may be logged, cached, or used for training. ...

As a SOC analyst, one of the most critical tasks is analyzing network flow data to identify potential security threats. In this post, we’ll explore how to combine cloud-based data storage, SQL querying, and AI-powered analysis to streamline this process. Collecting Flow Data in Amazon Athena Amazon Athena provides a serverless query service that makes it easy to analyze data directly in Amazon S3 using standard SQL. Here’s how we set up our flow data collection: ...