Alerts tell you "something is wrong now," but incident investigation, forensics, and threat hunting require the ability to freely ask historical logs: "What APIs did this IP call over the past 90 days?" or "Who changed this bucket policy?" In security exams, this domain reduces to distinguishing the proper use of three tools — Athena (query large logs stored in S3 with SQL, serverless, pay-per-use), OpenSearch (near-real-time indexing, dashboards, full-text search), and CloudWatch Logs Insights (immediately query logs already in CloudWatch Logs). The three are not competing — they split by data location and analysis timeliness.