GuardDuty and AWS Security Hub - Timing

Hi All,

Ive a quick question re: the timings of findings being generated and being accessible in AWS Security Hub via GuardDuty.

Without giving away the trade secrets, Im guessing there various step that take place from the point there is suspicious activity to it being available via the SecurityHub API.

Im guessing the steps would be:

1. Suspicious activity on the account taking place
2. GuardDuty observes and stores this finding
3. GuardDuty then passes this to Security Hub or does Security Hub have the same access to the GuardDuty repository (therefore does it get I the same time as GuardDuty finds it?)
4. Available to be pulled via the findings API

What are the timeframes of these steps?

Im trying to understand how quickly I can access the finding from the point the suspious activity happened.

Thanks all.