Automation of Forensic Analysis for AWS Aurora using EventBridge and Athena

Abstract

The advancement of cyber technology has a tremendous boost over the years which results in a threat to security as one outcome. So, the domain of forensics plays a crucial role in detecting and preventing various cyber threats. As a motto of minimizing hardware storage and computation, industries are moving towards the cloud platform which provides maximum services such as storage, computation, etc. at low cost and also based on the requirement. Therefore, this ideology has attracted several organizations and individuals in moving toward cloud platforms. Hence as an instinct, the threat of the CIA triad has also arrived on the cloud. In every software application, the database plays a major role, as a result, it has become a resource for attackers to gain information which resulted in various attacks on the database. Therefore, database monitoring has become an important role. To monitor or investigate the attack the logs of the database are used. Hence storing the logs is also a challenge since the logs shouldn't lose their integrity. This research work proposes a novel architecture with maximum throughput and a strong storing mechanism to automatically store the logs following a user-defined timeline analysis by using Athena, Lambda, and EventBridge along with strong security features such as encryption, versioning, etc. that guide the monitoring process and forensic analysis.