Transforming AWS Bedrock Guardrails Events to OCSF with CloudWatch
AWS details a method for transforming AWS Bedrock Guardrails intervention events into structured Open Cybersecurity Schema Framework (OCSF) Detection Finding records. This allows security teams to consolidate AI-related security telemetry with existing data in the CloudWatch unified data store. The approach enables SOC and threat analysts to perform cross-source correlation and investigation using tools like AWS Athena or CloudWatch Logs Insights. A custom AWS Lambda function is used for this transformation, as Bedrock Guardrails events require specific logic beyond CloudWatch's native OCSF conversion capabilities.
- →Integrating Bedrock Guardrails with Security Telemetry
- →Solution for OCSF Transformation and Consolidation
- →Custom Transformation for Bedrock Guardrails Events
Notes (3) ›
- Integrating Bedrock Guardrails with Security Telemetry
Security teams need guardrail intervention data alongside existing security telemetry to investigate possible AI-related security events, such as prompt injection attempts or sensitive data redactions. AWS Bedrock publishes this telemetry to CloudWatch metrics and model invocation logs, but it remains siloed from other crucial security data.
- Solution for OCSF Transformation and Consolidation
The solution captures guardrail intervention events from AWS Bedrock model invocation logs, transforms them into OCSF Detection Finding records using an AWS Lambda function, and lands them in the CloudWatch unified data store. This allows SOC and threat analysts to query guardrail events alongside identity, network, and endpoint data using AWS Athena or CloudWatch Logs Insights, enabling comprehensive cross-source correlation.
- Custom Transformation for Bedrock Guardrails Events
A custom Lambda function is necessary for this solution because AWS Bedrock Guardrails is not natively supported by CloudWatch's ParseToOCSF log transformation processor for automatic OCSF conversion. The custom step also handles specific transformation logic, such as splitting a single log entry with multiple guardrail assessments into distinct OCSF Detection Findings.
https://aws.amazon.com/blogs/security/transforming-bedrock-guardrails-events-into-ocsf-with-cloudwatch/
Related releases
- Moonshot AI's Kimi K3 Model Now Generally Available on Amazon Bedrock AWS What's New ·
- AWS launches next-gen AgentCore Runtime for Amazon Bedrock with improved performance AWS What's New ·
- Amazon Bedrock offers Gemma 4 open-weight models in European Sovereign Cloud AWS Security Blog ·
- AWS Bedrock Now Supports Open Weight Models in European Sovereign Cloud AWS Security Blog ·
- Kloia Accelerates .NET Modernization Blueprint Delivery on AWS with AI and Bedrock Modernizing with AWS Blog ·
- AWS Weekly Roundup: GPT-6 Astra on Bedrock, Quick Desktop GA, Lambda Timeout, and More AWS News Blog ·