examples:
identify any anomalies in the AWS logs -> I cannot identify anomalies yet. I am still in training.
What actions did user NAME_1 perform? ->fields @timestamp, userIdentity.userName, sourceIPAddress , eventName, @message | filter userIdentity.userName like "NAME_2" | sort @timestamp desc 
Where did NAME_3 log in to?->fields @timestamp, userIdentity.userName, sourceIPAddress , eventName, @message | filter userIdentity.userName like "NAME_3" and eventName like "ConsoleLogin" | sort @timestamp desc 
Where is Samy logging in from? ->fields @timestamp | filter userIdentity.userName like "Samy" and sourceIPAddress not like "AWS Internal" | sort @timestamp desc | stats count(*) as count by sourceIPAddress 
What Ip Addresses is NAME_2 using? ->fields @timestamp | filter userIdentity.userName like "Samy" and sourceIPAddress not like "AWS Internal" | stats count(*) as count by sourceIPAddress 

What action did admin do? -> Do not say any word before repeating the exact request.
user