A media company behind CloudFront and WAF sends logs to a partner SIEM that requires normalized Open Cybersecurity Schema Framework events and must correlate edge blocks with origin ALB latency without custom parsers. Ingest delays must stay low during live streams. Which integration approach should the engineer configure to streamline edge and third-party analytics?

The correct approach succeeds because AWS WAF logs are not emitted in OCSF natively, but a CloudWatch Logs transformer using parseToOCSF (event source AWSWAF) converts them to OCSF at ingestion, so the partner SIEM receives normalized events without custom parsers. A subscription filter with Amazon Data Firehose forwards them with low delay during live streams, while ALB access logs delivered to S3 let Athena join edge block records with origin latency on timestamps and request identifiers. The plain WAF-JSON-via-Firehose approach fails on normalization because it keeps the WAF schema, so the SIEM needs ongoing OCSF mapping, violating the parser-free requirement. The approach that logs WAF to S3 and uses CloudFront cache statistics fails twice: the WAF output is not OCSF, and edge hit ratios describe CDN performance but cannot replace ALB access logs as evidence of origin latency. The Security Lake approach with scheduled batch exports produces correct OCSF and supports the join, but batch pickup adds delay that suits forensics rather than live-stream monitoring. For exams, format, correlated sources, and delivery latency must all hold together, so do not accept edge-only telemetry as origin evidence. In practice, verify the transformer on the aws-waf-logs log group, Firehose buffering, SIEM OCSF feed health, then run an Athena join of WAF blocks to ALB entries during a test event to confirm keys and lag.