How EventBridge Routes Security Events

Amazon EventBridge is a serverless event bus that connects events from AWS services to targets that act on them.

For security, it is the glue between detection and response: a GuardDuty finding becomes an event, EventBridge routes it, and a target like Lambda automatically remediates — all in seconds.

An event is a JSON message describing something that happened — a finding raised, a resource changed, an API called.

AWS services emit events automatically. Each carries a source, a detail-type, and a detail object with specifics, which together let you match and route precisely.

Events arrive on an event bus. Every account has a default bus for AWS service events, and you can create custom buses for your own applications or partner integrations.

Separating buses keeps event traffic organized and lets you apply different rules and permissions to different streams.

A rule watches a bus and matches events against an event pattern. When an event matches, the rule sends it to one or more targets.

This source-to-target routing is the core of automated security: it decides which findings trigger which responses, without any polling or custom code to listen for events.

Rules can deliver matched events to many targets:

• Lambda functions for custom remediation.
• SNS topics to notify a team.
• Step Functions for multi-step workflows.
• Systems Manager Automation documents.

One event can fan out to several targets at once.

EventBridge enables the security automation pattern: a detector (GuardDuty, Macie, Config, Security Hub) emits a finding, a rule matches it, and a target remediates or alerts.

This turns manual triage into instant, consistent action, dramatically shrinking the time an attacker has between detection and containment.

EventBridge delivers events in near real time and is fully serverless — no infrastructure to manage and it scales automatically.

This speed is what makes auto-remediation viable: a high-severity finding can lead to an isolated resource within seconds of detection, far faster than any human responder could act.

EventBridge can send events from member accounts to a central security account's bus.

This centralizes detection and response: findings from across an organization land on one bus where shared rules and remediation logic handle them consistently, rather than duplicating automation in every account.

Beyond service events, EventBridge supports scheduled rules (cron-like) to run periodic security checks, and it captures CloudTrail API events so you can react to specific API calls.

For example, a rule can fire whenever someone disables a security control, triggering an immediate alert.

EventBridge can transform an event before passing it to a target, reshaping or trimming the JSON so the target receives exactly what it expects.

This lets one finding feed a notification with a friendly message and a remediation Lambda with raw details, without writing glue code to massage the payload in between.

For robust automation, EventBridge offers retries and a dead-letter queue (DLQ) for events that fail to deliver.

This ensures a transient failure does not silently drop a critical security action — a failed remediation lands in the DLQ for review rather than vanishing unnoticed.

Name EventBridge's role.

Amazon EventBridge is a serverless event bus that routes events from AWS services to targets using rules and event patterns. It is the link between detection and response: a finding from GuardDuty or Macie matches a rule and triggers a Lambda, SNS, or Step Functions target in near real time. It supports cross-account routing to a security account, scheduled and API-driven rules, and DLQ-backed retries for reliable automation.