A company stores sensitive data in AWS Secrets Manager. A security engineer must send an email notification when anomalous GetSecretValue API calls occur. An Amazon EventBridge rule is already configured to capture all Secrets Manager events delivered by AWS CloudTrail. Which solution meets these requirements?

The correct solution uses Amazon CloudWatch Logs as the target for the EventBridge rule. CloudTrail logs, which contain details about API calls like GetSecretValue, are sent to CloudWatch Logs. Within CloudWatch Logs, a metric filter can be created to extract relevant data, such as IncomingBytes, and anomaly detection can be enabled on this metric. An Amazon SNS topic is then used to send email notifications when the CloudWatch alarm, configured to monitor the anomalous behavior of the metric, triggers. Incorrect options: Setting CloudTrail as the target for EventBridge is incorrect because CloudTrail itself is the source of the events, not a target for processing them in this manner. CloudTrail alarms do not directly support anomaly detection on IncomingBytes for this use case. Using Amazon SQS for notifications is incorrect because the requirement is for email notifications, which SNS provides directly. While SQS could be part of a more complex notification system, SNS is the direct service for email. CloudWatch Logs Insights is for interactive querying and analysis, not for continuous, automated anomaly detection and alarming in this context.