Follow Amazon Security Lake stores your data in S3 as Parquet files in the OCSF schema, so you don’t download it directly. You query it. Use Amazon Athena with an UNLOAD statement and format = ‘JSON’: Athena writes the results as JSON lines to an S3 prefix you choose, and you download that. Security Lake tables live in a Glue database named amazon_security_lake_glue_db_<region>, one table per source.
Security Lake centralizes CloudTrail, VPC Flow Logs, Route 53, Security Hub findings, EKS audit logs and third-party sources in one normalized format. Prime Core has more than 24,000 unique detection rules, mapped to 676 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.
Before you start
Query access. Use the Security Lake delegated administrator account, or a subscriber with query access. Access is governed by Lake Formation, so you need SELECT on the tables, plus Athena permissions and write access to an S3 bucket for the export.
Find the tables. In Athena, open the database for your region. Table names follow the pattern amazon_security_lake_table_<region>_<source>_<version>, for example amazon_security_lake_table_eu_west_1_cloud_trail_mgmt_2_0. The region uses underscores.
Partitions keep costs down. Tables are partitioned by region, accountid and eventday (YYYYMMDD). Athena bills by data scanned, so always filter on eventday.
Export with Athena UNLOAD
In the Athena console, or with aws athena start-query-execution:
UNLOAD (
SELECT *
FROM amazon_security_lake_glue_db_eu_west_1.amazon_security_lake_table_eu_west_1_cloud_trail_mgmt_2_0
WHERE eventday = '20261019'
AND accountid = '123456789012'
)
TO 's3://my-athena-exports/security-lake/ct-20261019/'
WITH (format = 'JSON', compression = 'NONE')
The target prefix must be empty. When the query succeeds, download and combine the files:
aws s3 cp s3://my-athena-exports/security-lake/ct-20261019/ ./ct-20261019/ --recursive
cat ./ct-20261019/* > securitylake_ct_20261019.jsonl
Each line is one OCSF event. To narrow it further, filter on OCSF fields such as api.operation, actor.user.uid or src_endpoint.ip.
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the .jsonl file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Insufficient Lake Formation permissions | No SELECT grant on the table | Ask the Security Lake admin for a Lake Formation grant |
| Table not found | Wrong region in the database or table name | Use underscores: eu_west_1 |
| HIVE_PATH_ALREADY_EXISTS or similar | Target prefix isn’t empty | Use a new, empty prefix |
| Huge scan cost | No eventday filter | Always filter on partitions |
| Files are gzipped | Compression left at the default | Set compression = ‘NONE’, or use zcat |
FAQ
Can I read the Parquet files directly?
You can, with tools that read Parquet, but Athena handles the schema and partitions for you. For LogTotal, JSON lines from UNLOAD is the simplest route.
Is OCSF the same as raw CloudTrail?
No. Security Lake normalizes events into OCSF, so field names differ from the original source.
