A security engineer needs to send email alerts via Amazon Simple Notification Service (Amazon SNS) to the security team for Amazon GuardDuty findings with High severity. The engineer also needs to deliver these findings to a visualization platform for deeper analysis. Which solution meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Configure GuardDuty to send notifications to Amazon EventBridge with two targets. Use EventBridge to route findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain. Use OpenSearch Dashboards for visualization and queries. Configure an SNS topic as a second target. Use an EventBridge event pattern to match only High severity findings..
Why this is the answer
The correct solution leverages Amazon EventBridge as the central routing mechanism for GuardDuty findings. GuardDuty integrates directly with EventBridge, allowing for filtering based on severity (High in this case) using an EventBridge event pattern. EventBridge can then send these filtered findings to two targets: an Amazon SNS topic for email alerts and an Amazon Kinesis Data Firehose delivery stream. Kinesis Data Firehose is ideal for loading streaming data into data stores like Amazon OpenSearch Service for near real-time analytics and visualization using OpenSearch Dashboards. Incorrect options: CloudWatch alarms are for metrics, not for routing security findings. While CloudWatch can integrate with SNS, it's not the primary service for GuardDuty finding ingestion and routing. AWS CloudTrail records API activity, not GuardDuty findings directly. Using CloudTrail for this purpose would be an incorrect architectural choice. While Amazon Kinesis Data Streams can be used, Kinesis Data Firehose is generally simpler for direct ingestion into OpenSearch Service without managing consumer applications, making it a more efficient choice for this use case. Amazon QuickSight is a business intelligence service and while it can visualize data, OpenSearch Dashboards is natively integrated with OpenSearch Service for visualization and queries.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed