AWS - Advanced Security
You want to integrate GuardDuty findings with a SIEM system for centralized alerting. Which AWS service can you use to export findings in near real-time?
You want to integrate GuardDuty findings with a SIEM system for centralized alerting. Which AWS service can you use to export findings in near real-time?
hard📝 Application Q9 of 15
Step-by-Step Solution
Solution:
Step 1: Identify GuardDuty integration options
Amazon EventBridge can capture GuardDuty findings as events and forward them to external systems.Step 2: Exclude other services
CloudTrail logs API calls, Config tracks resource changes, SNS is for notifications but not event routing to SIEM directly.Final Answer:
Amazon EventBridge -> Option AQuick Check:
GuardDuty to SIEM = EventBridge A [OK]
Quick Trick: Use EventBridge to stream GuardDuty findings to SIEM [OK]
Common Mistakes:
- Using CloudTrail or Config for GuardDuty event export
- Assuming SNS directly integrates with SIEM
Master "Advanced Security" in AWS
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore AWS Quizzes