A company operates a microservices architecture on AWS using Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Aurora. The company manages hundreds of AWS accounts with AWS Organizations and needs a centralized logging and security monitoring solution across all accounts. The solution must automatically detect security issues with minimal operational overhead. Which approach best meets these requirements?

The correct approach leverages Amazon GuardDuty's capabilities for centralized threat detection. Appointing a GuardDuty administrator in the management account allows for automatic enablement and management across all member accounts in AWS Organizations. Enabling EKS Protection and RDS Protection directly addresses the microservices architecture using EKS and Aurora, providing specialized threat detection for these services with minimal operational overhead. Incorrect options: Using CloudWatch Logs with Amazon Inspector for log evaluation is not Inspector's primary function; Inspector focuses on vulnerability management, not real-time threat detection from logs. Centralizing CloudTrail logs in S3 and using Athena is good for auditing and forensics, but it's a reactive query-based approach, not an automatic, real-time security issue detection solution like GuardDuty. Aurora logs are not typically published to CloudTrail. Using Kinesis and Lambda for custom log processing is a valid approach for advanced analytics but requires significant development and maintenance overhead, which goes against the "minimal operational overhead" requirement.