Even with detection (GuardDuty), aggregation (Security Hub), and analysis (Athena/OpenSearch), if humans manually triage and respond to every finding, operations collapse quickly. The nervous system of security automation is Amazon EventBridge — an event bus across AWS that filters events with rules and routes them to targets. In security exams, EventBridge is the router linking "finding → appropriate response action" and the mechanism that closes the detection-response loop. We also cover today the higher-level concept that normalizes and integrates security logs across the organization: Security Lake.