Log Analysis at Scale

Reading terabytes without drowning: Security Lake and the OCSF normalization that makes a common query possible, picking between Logs Insights, Athena, OpenSearch and Managed Grafana on cost and latency, and correlating sources into one incident timeline.

Content current as of 2026-10.

Lessons

1. Security Lake and OCSF
2. Querying at scale
3. Normalizing and correlating

Sources

• SCS-C03 exam guide — Content Domain 1 (tasks 1.1–1.3)
• Open Cybersecurity Schema Framework (OCSF) in Security Lake
• Amazon Security Lake — source management
• Amazon Athena — partition projection