A retail platform suffered checkout fraud spanning ALB access logs, WAF logs, and application JSON logs in CloudWatch, and analysts must run ad-hoc joins by IP and trace ID across all three sources for the last 7 days. Which log search and correlation approach should the responder choose to investigate this fraud event?
Select an answer to reveal the explanation.
Short Explanation
You can make this investigation easier by giving the different logs a shared structure and a query engine. OCSF normalization in Security Lake lets Athena join the ALB, WAF, and application events by IP address and trace ID.
Full Explanation
Centralizing the ALB access logs, WAF logs, and application JSON logs in Security Lake using OCSF gives the events a common structure, and Athena can query across those sources to join records by IP address and trace ID for the seven-day fraud investigation. Enabling VPC Flow Logs alone will not reconstruct the checkout timeline: flow records contain network connection metadata, not the HTTP details, WAF rule matches, or application trace context needed to connect the events. Manually exporting each log group to S3 and opening files in a text editor does not provide scalable, ad-hoc joins or efficient time correlation across sources. GuardDuty alone provides threat findings, but its findings timeline is not a query layer for arbitrary joins on IP addresses and custom application trace IDs. The exam caveat is that a single-source security feed, even when useful for detection or network investigation, cannot replace centralized, normalized data and cross-source querying when the requirement is correlation. In practice, confirm that all three log sources are onboarded, that the seven-day partitions are available, and that the IP and trace ID fields map consistently before running the investigation.