Transforming AWS Bedrock Guardrails Events into OCSF with CloudWatch

Integrating AI Security Telemetry

Security teams need to incorporate AI-related security events, such as guardrail interventions, into their existing security telemetry. When an AWS Bedrock guardrail blocks a prompt injection attempt or redacts sensitive data, this intervention provides investigative value similar to other security alerts like failed sign-ins or network intrusions. AWS Bedrock publishes this telemetry to AWS CloudWatch metrics and model invocation logs for operational monitoring.

OCSF Transformation and CloudWatch Integration

AWS Bedrock Guardrails intervention events can now be transformed into structured Open Cybersecurity Schema Framework (OCSF) Detection Finding records. These OCSF records are then landed in the CloudWatch unified data store, which was launched in December 2025. This unified data store consolidates operational, security, and compliance data from various AWS services and third-party sources onto a single platform.

Enhanced Security Operations

Security operations center (SOC) and threat analysts can query these guardrail events alongside other critical data, including identity, network, and endpoint information like AWS CloudTrail and AWS Virtual Private Cloud (AWS VPC) Flow Logs. This integrated data can be analyzed using tools such as AWS Athena or CloudWatch Logs Insights, enabling a more comprehensive view of security incidents.

Addressing Data Silos

Organizations deploying AWS Bedrock often face challenges with guardrail interventions remaining siloed in per-AWS Region CloudWatch metrics and raw model invocation logs. The CloudWatch unified data store addresses this by consolidating operational and security data across accounts and Regions. Routing normalized guardrail records into this store makes them correlatable with other security telemetry, facilitating more effective investigations.