A security engineer needs continuous threat detection across CloudTrail, VPC Flow Logs, DNS logs, and EKS audit logs in a multi-account AWS Organization, with findings centralized in a security account. Which combination is the canonical AWS-native fit?

• AManually parse logs in Athena and write custom detection rules
• BEnable Amazon GuardDuty across the Organization with the security account designated as the delegated administrator; aggregate findings in Security Hub
• CSubscribe to a third-party SIEM and disable GuardDuty
• DInstall antivirus on every EC2 instance