After a credential leak, a gaming studio sees odd Lambda invocations, S3 access, and login spikes but cannot connect events across CloudTrail, VPC, and app logs. Analysts need unified search and timeline correlation. Which log search and correlation approach should the responder deploy to trace the attack chain?

The correct approach centralizes CloudTrail, VPC Flow Logs, and Route 53 as native sources plus application logs as a custom source, all OCSF-normalized data in Amazon Security Lake backed by S3, then uses Amazon Athena for SQL search across partitions and OpenSearch or Lake Formation queries to correlate principals, IPs, and time windows into a single incident timeline. Enabling GuardDuty with EventBridge ticketing fails by concept because GuardDuty provides anomaly findings and automation, not ad hoc unified log search and cross-source correlation needed to hunt the full chain, while turning on CloudTrail Insights and Config timelines fails because Insights highlights unusual API activity and Config shows resource history but neither normalizes multi-service app logs for investigator-driven queries. Exporting CloudWatch Logs weekly for offline review fails because batch CSV handling is slow, non-normalized, and unsuitable for rapid pivoting across large distributed telemetry. For the exam, link Security Lake plus Athena to centralized OCSF search and correlation, and in practice verify partition onboarding, save Athena queries for IOCs, and preserve original logs with Object Lock for forensics.