A global enterprise aggregates CloudTrail, VPC, and Security Hub findings into OCSF, needs 7-year retention, and must feed a third-party SIEM without custom parsers. Security teams need delegated administration and automatic collection from new accounts. Which log storage and data lake integration should the architect implement for centralized analytics?
Select an answer to reveal the explanation.
Short Explanation
You can spare your SIEM team custom-parser work by choosing a lake that normalizes findings before they arrive. OCSF gives subscribers a consistent schema, while delegated administration and lifecycle retention support centralized operations and long-term storage.
Full Explanation
Amazon Security Lake fits the requirements because it collects CloudTrail, VPC flow logs, and Security Hub findings, normalizes them to OCSF, supports delegated administration and automatic collection from new organization accounts, and lets you set seven-year lifecycle retention and provide SIEM subscriber access without custom parsers. A centralized S3 data lake for those logs can provide seven-year retention and automated delivery, but it does not itself normalize the sources to OCSF, so the SIEM would still need custom parsing. Security Lake with OCSF and automatic collection but only a 90-day SIEM subscription falls short of the required seven-year retention, leaving the specified long-term compliance need unmet. Security Lake with OCSF and seven-year retention in each account preserves normalization and durability, but manual subscriber setup and account-by-account deployment do not provide the requested delegated administration or automatic collection as new accounts appear. Exam caveat: distinguish Security Lake’s OCSF normalization and subscriber model from centralized S3 storage, which can retain and deliver logs without standardizing their schemas. As a practical check, confirm the delegated administrator, enabled sources, seven-year lifecycle policy, automatic account collection, and active SIEM subscriber access.