In a multi-account setup, the company routes all outbound traffic through a Transit Gateway into a network operations account. There, traffic is inspected by a firewall appliance before reaching the internet gateway. The firewall writes logs to CloudWatch Logs and classifies events as CRITICAL, HIGH, MEDIUM, LOW, and INFO. The security team must be alerted whenever any CRITICAL events appear. What should the DevOps engineer implement to satisfy this requirement?

The correct solution leverages CloudWatch Logs metric filters to directly monitor the firewall logs for "CRITICAL" events. When a CRITICAL event is found, the filter increments a custom metric. A CloudWatch alarm is then configured to trigger when this custom metric meets a defined threshold, publishing a notification to an SNS topic. The security team's email is subscribed to this SNS topic, ensuring they receive immediate alerts. This method is efficient and directly addresses the requirement of alerting on specific log patterns. Incorrect options: CloudWatch Synthetics canaries are for monitoring application endpoints or URLs, not for parsing logs from a firewall appliance. Amazon GuardDuty analyzes AWS account and network activity for threats, not specific log entries from a third-party firewall appliance. AWS Firewall Manager centrally manages firewall rules across accounts but doesn't directly monitor or alert on specific log content from a firewall appliance.