A media company fronts APIs with CloudFront and WAF and must stream WAF detections to its third-party SIEM in a normalized vendor-neutral schema for unified correlation with other clouds. Which edge integration delivers normalized detections to the SIEM?
Select an answer to reveal the explanation.
Short Explanation
Your SIEM speaks one language for every cloud, so feed it that dialect. Normalization via Security Lake converts WAF logs to OCSF automatically for easy correlation.
Full Explanation
The correct design succeeds because Security Lake collects WAF logs in S3 and converts them to OCSF, so a subscribed third-party SIEM receives normalized vendor-neutral detections ready for unified correlation with other clouds without custom parsers and with centralized lifecycle management. Directly streaming WAF logs through Kinesis Data Firehose to the SIEM in native JSON fails the normalization concept because transport and low latency are excellent but the AWS-specific schema is preserved, preventing unified multi-cloud correlation. Retaining normalized WAF data in Security Lake for Athena queries fails the delivery concept because OCSF conversion is achieved yet the external SIEM receives no subscribed feed, so centralized detection across clouds never occurs. Sending CloudFront real-time access logs to the SIEM fails the source-signal concept because edge traffic visibility helps performance analysis but lacks WAF rule evaluations, blocks, and bot decisions needed for detection. As an exam caveat, separate movement from meaning, since Firehose, Kinesis, and S3 prove delivery while only Security Lake proves OCSF transformation. As a practical check, confirm the WAF source is enabled in Security Lake in the correct Region, inspect S3 for OCSF event classes, and verify the subscriber IAM role and notifications reach the SIEM within minutes of a test block.