Transforming Bedrock Guardrails events into OCSF with CloudWatch

Summary

AWS describes a method for converting Amazon Bedrock Guardrails intervention events into OCSF Detection Finding records and loading them into the CloudWatch unified data store, which launched in December 2025. The approach lets security teams query guardrail events alongside CloudTrail, VPC Flow Logs and identity data using Athena or CloudWatch Logs Insights. The post presents this pipeline as complementary to GuardDuty AI Protection rather than a replacement for it.

Related items

• InfoUnited Airlines blocks AI agents from booking flights, citing cybersecurity risksSame vendor · TechCrunch (Security)
• InfoStraiker EU & India Expansion | Regional AWS HostingSame vendor · Straiker Blog
• InfoJim Cramer: This is the bet you're making if you buy the Anthropic IPOSame vendor · CNBC Technology
• MediumAntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production SecretsSame vendor · The Hacker News
• InfoAnthropic's IPO roadshow videoSame vendor · Simon Willison's Weblog