Prerequisite:
Only Cmd Audit and Cmd Control provide data export functionality.
How to query Cmd data with AWS Athena
By using AWS Athena with Presto, you can easily run SQL queries on Cmd data stored in S3. You must first create a database with the necessary tables. There are two ways to do this:
Use Athena’s SQL query interface and run SQL scripts to create the database and tables. While creating the tables, you will need to provide the schema of your Cmd data, as well as information about the S3 bucket with your Cmd data.
Alternatively, use a crawler from AWS Glue’s Data Catalog to infer the schema of your S3 data, and automatically create or update tables which you can then query using Athena.
If you plan to query your data regularly, you may want to consider preprocessing it for optimized performance and reduced cost.
If you have any further questions, feel free to contact us.