17 organizations publicly document querying security logs with Amazon Athena — CloudTrail hunting and WAF tuning lead the use cases

Asked:

“who uses AWS athena to run queries on their unstructured security logs?”

Public web evidence as of 2 November 2026 names 17 organizations or security teams using Amazon Athena to query raw or semi-structured security data — CloudTrail, WAF logs, VPC flow logs, JSON events, and mixed security data lakes — across 12 independent source hosts. This is a public-evidence list, not an exhaustive census, and a blank status does not mean the implementation is still current.

Who queries what: 17 organizations grouped by security-log use case

Hover or tap a tile for the documented Athena use. Colour marks the kind of evidence behind each claim. Zepto appears under WAF logs but also queries CloudTrail.

AWS or company first-party source vendor or case-study site practitioner or secondary page

Findings

Canva analyzes more than 50 million security logs every day with an Athena-backed data lake for automated threat detection and investigation. casestudies.com

Four marquee names — Airbnb, Capital One, Netflix and Stripe — rest on a single practitioner page describing a Python-plus-Athena stack that scans CloudTrail across thousands of AWS accounts; treat them as secondary claims. johal.in

AWS first-party pages document Zurich Insurance Group (historical security-log audit), Imperva (Cloud WAF event analytics), ecbeing (WAF rule tuning) and Siemens CDC (JSON security data in its ARGOS platform). aws.amazon.com

Athena's raw-scan speed is a known limit: Guardant Health found CloudTrail queries slow, and Zepto saw 5–10-minute full scans before adding an indexing layer. exaforce.com

All 17 organizations, sourced

Organization	Security data queried	Documented Athena use	Status	Source

Method: 17 rows compiled from broad web research across AWS customer stories, company engineering material, vendor case studies and practitioner write-ups, as of 2026-11-02. Each row is one named organization with the security data it queries in Athena and its source URL. The 17 rows span 12 independent hosts; at most 4 rows (23.5%) rest on one URL (the johal.in practitioner page naming Airbnb, Capital One, Netflix and Stripe). Sources say “logs”, “JSON events”, “flow logs” or “CloudTrail” rather than literally “unstructured”. Blank status means currency was not stated; long use descriptions are shortened in the table.

This report was generated automatically by Keenable SELECT at a user's request, from publicly available web sources linked herein. Keenable does not review, verify, or endorse its contents and makes no representation as to accuracy, completeness, or timeliness; AI-based extraction may contain errors. Nothing in this report is investment, legal, financial, or other professional advice. All trademarks and referenced content remain the property of their respective owners; no affiliation or endorsement is implied. To report an error, rights concern, or request removal: legal@keenable.ai.