An organization wants continuous detection of suspicious account activity using threat intelligence and AWS telemetry, with findings aggregated by a delegated administrator. Which service is the most direct fit?

1. AWS Config as the sole detector of anomalous API behavior.
2. Amazon GuardDuty with organization-based administration and required protection plans.
3. AWS Artifact as the live suspicious-activity detection engine.
4. Amazon Inspector as the sole detector of every suspicious login.