A company uses Amazon GuardDuty. The security team wants every High severity finding to automatically create a ticket in a third-party ticketing system via email. Which approach meets this requirement?

This approach correctly leverages EventBridge to detect specific GuardDuty findings and SNS to deliver notifications. EventBridge can filter GuardDuty findings based on severity, and an SNS topic can have an email address as a subscriber, enabling direct email delivery to the ticketing system. The first incorrect option is wrong because EventBridge cannot directly target an SES identity for sending emails. SES is for sending emails from verified identities, not for receiving EventBridge events. The third and fourth incorrect options are wrong because the CreateFilter API is used to manage GuardDuty finding filters within GuardDuty itself, not to directly export findings or to define EventBridge rule conditions. EventBridge rules directly match patterns in event streams, including GuardDuty findings, without needing a separate GuardDuty filter API call for this purpose.