Athena User Guide¶
Concepts¶
Querying Data¶
All alerts generated by StreamAlert will be sent to an alerts
S3 bucket via Firehose. These will then be searchable within Athena.
To get started with querying of this data, navigate to the AWS Console, click Services, and type ‘Athena’.
When the service loads, switch the DATABASE
option in the dropdown to streamalert
:
To view the schema of the alerts
table, click the eye icon:
To make a query, type a SQL statement in the Query Editor, and click Run Query:
The query shown above will show the most recent 10 alerts.
Tips¶
Data is partitioned in the following format YYYY-MM-DD-hh-mm
.
An example is 2017-08-01-22-00
.
To increase query performance, filter data within a specific partition or range of partitions.
With StreamAlert tables, the date partition is the dt
column.
As an example, the query below counts all alerts during a given minute:
For additional guidance on using SQL, visit the link under Concepts.