Security teams can now route Amazon Bedrock Guardrails intervention events to Amazon Security Lake, enabling unified querying of guardrail data alongside identity, network, and application security telemetry. Amazon Bedrock publishes this telemetry to Amazon CloudWatch metrics and model invocation logs for operational monitoring. The integration transforms guardrail intervention events into Open Cybersecurity Schema Framework (OCSF) records and delivers them to Security Lake as a custom source, queryable via Amazon Athena or any Security Lake subscriber. A use case describes a financial services organization deploying Amazon Bedrock across multiple business units, using guardrails to enforce content policies, topic policies, sensitive information policies, and prompt injection detection. The security team needs to identify which user accounts trigger the most guardrail interventions and whether those accounts also have unusual AWS Identity and Access Management (IAM) activity, determine if prompt injection attempts correlate with specific source IP addresses that also appear in Amazon Virtual Private Cloud (Amazon VPC) Flow Logs, and track the organization-wide trend of guardrail violations across all business units compared against the baseline from 30 days ago. The pipeline architecture routes Amazon Bedrock security events to Security Lake as OCSF-compliant records, using subscription filter, AWS Lambda transformation, Parquet writer, and Amazon Simple Storage Service (Amazon S3) partitioning. The solution captures Amazon Bedrock model invocation logs containing guardrail trace data, filters for intervention events, transforms matching events into OCSF-compliant Detection Finding records (class_uid 200