CortexRetail’s incident response team is investigating potential SSH brute-force attempts. VPC Flow Logs from three VPCs are delivered to separate CloudWatch Logs log groups. The team needs, within minutes, a ranked list of the top 10 source IPs with REJECTed traffic to destination port 22 over the last 15 minutes across all VPCs. What should they do?

The correct answer is to run a single CloudWatch Logs Insights query across all VPC Flow Logs log groups because Logs Insights is designed for interactive, real-time analysis of log data. It allows querying multiple log groups simultaneously and provides powerful query language features like filter, stats, sort, and limit to quickly identify the top source IPs for rejected SSH traffic within the specified timeframe. Creating CloudWatch metric filters and alarms would notify of rejected traffic but wouldn't immediately provide a ranked list of top offenders without additional manual aggregation. Exporting logs to S3 and using Athena is a valid approach for historical analysis but is slower and more complex for immediate, "within minutes" investigations. CloudTrail Lake is for querying CloudTrail events, not VPC Flow Logs.