Ticket summary
On 11 August 2026 the CedarGrid SOC opened IR-2026-0811-031 after GuardDuty reported Recon:EC2/PortProbeUnprotectedPort against the public web instance that serves console.cedargrid.io. No customer outage is confirmed. You are the investigating analyst.
CedarGrid runs a lift-and-shift customer console on a single EC2 instance behind an internet gateway. The instance has a public IP, nginx on 80/443, SSH, and a small admin process used by platform engineering. GuardDuty flagged an external host probing the instance.
The ticket includes six exports for the afternoon window: the GuardDuty finding, VPC Flow Logs, the instance record, the attached security group, host/application logs, and a CloudTrail slice. Your job is to identify the scanner, determine which ports were reachable, and decide whether this is reconnaissance only or a confirmed compromise.
A port-probe finding is not the same as a successful intrusion. Correlate the remote IP through flow logs, security group rules, and server logs before you recommend containment.