Question

A security engineer at a large enterprise manages a multi-account AWS Organization. The security team wants a single dashboard that aggregates findings from GuardDuty, Amazon Inspector, and Amazon Macie across all member accounts and multiple Regions, with findings expressed in a common data format so they can build consistent EventBridge automation rules regardless of the originating service. What is the MOST appropriate way to meet these requirements with the least custom development?

Accepted Answer

Enable AWS Security Hub with the delegated administrator account and cross-Region aggregation, which normalizes findings from integrated services into the AWS Security Finding Format (ASFF).

Answer

Enable Amazon Detective as the delegated administrator to correlate and normalize findings from all services into a unified graph model.

Answer

Build a Lambda function subscribed to each service's EventBridge events that transforms every finding into a custom JSON schema and writes them to a central S3 bucket.

Answer

Configure GuardDuty as the aggregation service since it already ingests Inspector and Macie findings and forwards them in a standard format.