A company uses a collaboration application. The security engineer needs automated alerts from AWS Security Hub in the us-west-2 Region to appear in a channel whenever Security Hub receives a new finding. A Lambda function reformats the message and sends it to the application’s API. An Amazon EventBridge rule targets the Lambda function. After enabling the rule, the channel is flooded with alerts, many from Amazon Inspector that require no action. With the least operational effort, how can the engineer stop the Amazon Inspector alerts?

The EventBridge rule's event pattern is the most efficient way to filter events before they trigger the Lambda function. By using anything-but for the ProductArn attribute, you instruct EventBridge to only forward events that do not originate from Amazon Inspector, directly addressing the problem with minimal operational overhead. Updating the Lambda function code would require modifying and redeploying code, which is more complex than a simple EventBridge rule change. Creating a Security Hub custom action is not designed for filtering specific service findings from being sent to EventBridge; it's for initiating actions on selected findings. Using an SNS topic with a subscription filter policy would add an unnecessary component (SNS) to the architecture, increasing complexity and latency compared to direct filtering at the EventBridge rule level.