16 leads show Athena querying raw security logs today — Canva, Beyond Inc and a wave of CloudTrail hunters lead the pack
Asked:
“find me people/companies doing this today. - uses AWS athena to run queries on their unstructured security logs”
16 company and practitioner leads with public evidence of running Amazon Athena over raw or semi-structured security logs — CloudTrail, WAF, VPC Flow, ALB and full security data lakes. Evidence dates span August 2021 to October 2026; 11 of 16 leads are dated within the last two years. Compiled from broad web searches (~1,200–1,500 results each) screened down to these 16, across 10 independent source hosts.
Each mark is one lead, placed by evidence date and log category. Colour: company practitioner. Rings mark vendor-published customer evidence; filled marks are firsthand posts; grey labels are pre-2024 historical references.
Canva’s security data lake runs 50M+ log records a day through Athena for attack indicators, forensics and threat hunting — the freshest and largest direct-use evidence here. aws.amazon.com
CloudTrail dominates: 9 of 16 leads query CloudTrail with Athena, from Capital One monitoring thousands of accounts to Luke Johnson’s MITRE-mapped multi-account hunt library. johal.in
Beyond Inc is the clearest hands-on company case outside AWS marketing: an engineer built a partition-projected Athena table over the company’s live WAF logs in S3. beyondjapan.com
Imperva, Orca Security and Goldman Sachs are older vendor-published references (2021–2023) — solid proof of past adoption, not confirmation the exact workflow runs unchanged today. aws.amazon.com
All 16 leads
Lead
Type
Logs queried
What they do with Athena
Evidence
Date
Source
Method: 16 leads (7 companies, 9 practitioners) with public evidence of querying security logs via Amazon Athena, gathered from broad web searches (~1,200–1,500 results per search) with semantic screening and deduplication; final rows span 10 independent hosts, the largest contributing 4 of 16, one URL per lead. Evidence dates 2021-08 to 2026-10. Dates are publication/evidence dates, not deployment dates; practitioner posts include demos and research, labelled by evidence context. Long use-case text truncated in the table; full detail at each source.