Security Hub aggregates GuardDuty/Inspector/Config findings across the org. A team wants one-click remediation — sending a finding to a Lambda that isolates the instance. Which feature connects findings to actions?
A.Security Hub custom actions → EventBridge → Lambda
Finding → custom action → EventBridge → remediation. Correct.
B.CloudTrail event history
CloudTrail is audit history — not a response trigger on findings.
C.Config remediation rules
Config remediation fixes config drift — not generic finding actions.
D.Inspector suppression rules
Suppression hides findings — opposite of acting on them.
Why this answer
Security Hub custom actions send findings to EventBridge as events — the standard pattern for semi-automated response: operator reviews → clicks action → EventBridge → Lambda/SSM remediation.
Correct answer: A · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Detection & Response practice session.
Practice Detection & Response