A security team wants managed detection of suspicious API activity and potential compromised credentials, including unusual calls associated with known threats. The team does not want to maintain its own detection engine. Which service most directly meets this requirement?

1. Enable Security Hub alone and aggregate existing findings without enabling a threat-detection data source.
2. AWS Trusted Advisor, because its cost recommendations block compromised credentials.
3. Amazon GuardDuty, with findings routed to the team's security response workflow.
4. Amazon Macie, because all unusual API activity is a sensitive-data classification event.