A fintech runs workloads in three accounts sending CloudTrail, VPC flow, and WAF logs to a central S3 bucket. Analysts need parsed fields, a common schema, cross-source correlation, and persistent dashboards for threat hunting. Which log normalization and correlation architecture should the team implement?

The correct architecture works because Lambda provides the parsing and normalization layer that converts disparate CloudTrail JSON, VPC flow log space-delimited records, and WAF logs into a unified schema before indexing, while OpenSearch Service supplies full-text search, cross-index joins and saved persistent dashboards required for iterative threat hunting across three accounts from the central S3 bucket. Direct ingestion from S3 into OpenSearch with dashboards appears efficient and preserves search and visualization, but it fails the normalization concept because unparsed source-native fields cannot be reliably correlated across sources with different field names and types. Lambda normalization for Athena-based queries satisfies parsing and even enables cross-source SQL joins, yet it fails the persistence concept because Athena is optimized for ad hoc interactive queries rather than always-on hunter dashboards with alerting and drill-downs. Normalizing into separate per-source indexes with dedicated dashboards meets parsing and visualization needs, but it fails the correlation concept because siloed indexes force analysts to pivot manually and prevent unified timeline and entity-centric hunting. For exams, remember that any answer lacking an explicit common-schema step cannot meet a stated parsed-fields requirement even if it offers powerful search. In practice, validate by confirming normalized fields exist in the index mapping, that a single query can pivot an IP from VPC flows to CloudTrail and WAF, and that dashboards persist and refresh for the hunt team.