VPC Flow Log Anomaly Detection: Amazon Detective + Athena ML

Learn how to implement VPC flow log anomaly detection by combining Amazon Detective's graph-based investigation with Athena ML queries to surface real network threats.

You'll learn:

• How Amazon Detective ingests VPC flow logs and builds behavior baselines using machine learning automatically
• Writing Athena ML USING FUNCTION queries against flow log data in S3 to flag statistical outliers in traffic volume or destination ports
• How to tie Detective findings back to specific ENIs, IAM roles, and EC2 instances for faster blast-radius assessment
• Where Athena ML ends and Detective begins — and why using both beats either alone for senior-level interviews
• Common gotchas: log format versions, partition projection in Athena, and Detective's 48-hour data warm-up window

Keywords: VPC flow logs anomaly detection, Amazon Detective interview, Athena ML queries AWS, cloud security monitoring interview, AWS network threat detection

🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud