A start-up firm has enabled a threat detection service Amazon GuardDuty to monitor malicious activity within its AWS accounts. Management is looking for the frequency of CloudWatch Event notifications that will be generated when there is a new finding in Amazon GuardDuty.
Which is the correct statement for CloudWatch Event notifications for Amazon GuardDuty findings?

Answer options:

A.For every finding based upon a unique finding ID, Amazon GuardDuty sends initial CloudWatch events notifications within 5 minutes of the findings and all subsequent findings every 6 hours.
B.For every finding based upon a unique finding ID, Amazon GuardDuty sends initial CloudWatch events notifications within 5 minutes of the findings and all subsequent findings every 12 hours.
C.For every finding based upon a unique finding type, Amazon GuardDuty sends initial CloudWatch events notifications within 10 minutes of the findings and all subsequent findings every 1 hour.
D.For every finding based upon a unique finding type, Amazon GuardDuty sends initial CloudWatch events notifications within 5 minutes of the findings and all subsequent findings every 24 hours.

Correct Answer: A
Amazon GuardDuty creates an event for Amazon CloudWatch Events when any change in findings occurs. For each of the findings, a finding ID is assigned. For newly generated findings with unique finding ID, notifications are sent within 5 minutes of the findings. But all subsequent findings are aggregated to a single event, and notifications are sent every 6 hours.
Option B is incorrect as the frequency of the notifications for all subsequent findings is 6 hours by default and not 12 hours. Frequency can be modified to either 15 mins, 1 hour or default 6 hours.
Option C is incorrect as notifications are sent based upon unique finding ID and not on finding type.
Option D is incorrect as notifications are sent based upon unique finding ID and not on finding type.
For more information on Amazon CloudWatch events with Amazon GuardDuty, refer to the following URL,
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings_cloudwatch.html