Question

A security analyst needs to investigate potential port-scanning activity against instances in a production VPC. VPC Flow Logs are already being delivered to an S3 bucket in Parquet format, and the analyst wants to run ad hoc SQL queries to identify source IP addresses generating a high volume of REJECT records across many distinct destination ports within a specific one-hour window. What is the MOST efficient way to accomplish this without provisioning additional infrastructure?

Accepted Answer

Create an Amazon Athena table over the S3 flow logs location and query rows where action = 'REJECT', grouping by source address and counting distinct destination ports.

Answer

Enable CloudWatch Logs Insights on the S3 bucket and use the stats command to aggregate rejected connections by source IP.

Answer

Launch an EMR cluster with Spark to parse the Parquet files and aggregate REJECT records by source address before terminating the cluster.

Answer

Configure a Kinesis Data Firehose delivery stream to reprocess the flow logs into OpenSearch Service and build a dashboard filtering on rejected traffic.