After a phishing wave, a city needs org-wide visibility into suspic…

Question

After a phishing wave, a city needs org-wide visibility into suspicious API activity correlated across accounts for investigation and notifications. Which approach should the architect prescribe?

Accepted Answer

Designate a security tooling account with Amazon GuardDuty and AWS Security Hub (or equivalent EventBridge fan-in) to aggregate and notify on correlated multi-account findings. — Think of one city-wide 911 console instead of every precinct keeping its own paper tip jar. Central GuardDuty/Security Hub (with EventBridge into a security account) correlates suspicious API activity across accounts so phishing fallout is visible org-wide. Weekly screenshot emails, turning GuardDuty off, or dumping keys in a bucket leave the SOC blind.

Answer

Rely on each department to review its own CloudTrail console once a week and email screenshots to the SOC.

Answer

Disable GuardDuty in member accounts to reduce finding noise and keep only VPC Flow Logs in the networking account.

Answer

Store long-lived access keys for every account in a shared S3 bucket so the SOC can poll DescribeEvents manually.

After a phishing wave, a city needs org-wide visibility into suspicious API activity correlated across accounts for investigation and notifications. Which approach should the architect prescribe?

Short Explanation

Full Explanation