Skip to main content

Amazon Athena

Amazon Athena is an interactive serverless query service provided by Amazon Web Services (AWS) that enables users to analyze data directly in Amazon S3 using standard SQL. As a fully managed analytics service, Athena eliminates the need for complex ETL processes or infrastructure management, allowing data engineers, analysts, and security teams to query large datasets stored in various formats including CSV, JSON, Parquet, ORC, and Avro.

CategoryData warehouse
DirectionQuery source
Sign-inAWS IAM
Query languagesSTIX
Websitehttp://aws.com

Before you start​

Huntbase signs in to Amazon Athena with AWS IAM. Create the credential in Amazon Athena first, then keep it to hand for the Connect step.

  1. Open the IAM console at https://console.aws.amazon.com/iam/, choose Users, and open the user Huntbase will use.
  2. On the Security credentials tab, in the Access keys section, choose Create access key. Choose Other, then Next, then Create access key.
  3. On the Retrieve access key page, choose Show or Download .csv file to save the access key ID and secret access key. This is the only time you can see the secret.
  4. Optionally, to use role-based access, copy the ARN of an IAM role that this user is allowed to assume.

Permissions:

  • Athena: ListWorkGroups, StartQueryExecution, GetQueryExecution, GetQueryResults and StopQueryExecution.
  • Amazon S3: GetObject on the query result location, plus read access to the S3 locations that hold the data you query.
  • Read access to the AWS Glue Data Catalog databases and tables you query.
Watch out for
  • Anyone with GetObject on the query result location can read query results. Keep that bucket restricted.

For the vendor's own instructions, see AWS IAM access key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Amazon Athena​

  1. Go to Connections and click New connection, or click New connection on the Amazon Athena product page.
  2. On Product, pick Amazon Athena and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Amazon Athena lives:

FieldRequiredNotes
RegionYesThe AWS Region where your Athena tables live, such as us-east-1.
S3 Bucket LocationYesThe S3 path where Athena writes query results, such as s3://my-athena-results/.
VPC Flow Database NameNoSpecify the name of the database containing the VPC Flow Logs.
VPC Flow Table NameNoSpecify the name of the table containing the VPC Flow Logs.
OCSF Database NameNoSpecify the name of the database containing the OCSF Logs.
OCSF Table NameNoSpecify the name of the table containing the OCSF Logs.
GuardDuty Database NameNoSpecify the name of the database containing the Amazon GuardDuty logs.
GuardDuty Table NameNoSpecify the name of the table containing the Amazon GuardDuty logs.

Credentials​

The only Method is AWS IAM. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
AWS Access Key IDNoAWS Access Key ID is required for both AWS key-based and role-based authentication. Secret — not shown again after you save it.
AWS Secret Access KeyNoAWS Secret Access Key ID is required for both AWS key-based and role-based authentication. Secret — not shown again after you save it.
AWS IAM Role ARNNoOnly needed for role-based access. Leave it empty to use the access keys directly. Secret — not shown again after you save it.
AWS Assume Role External IDNoExternal ID is optional for using in AWS role-based authentication. Secret — not shown again after you save it.

Query it​

Once connected, Amazon Athena can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​