Ticket summary
On 19 August 2026 MeridianOps Cloud security monitoring detected an unusual increase in failed authentication attempts against a production RDS database. Application traffic still looks broadly normal, but repeated failures from an external source have raised concern. You are the investigating SOC analyst.
MeridianOps Cloud runs customer-facing workloads in AWS account 851725491209 (ap-south-1). Production relational data is hosted on Amazon RDS. The database team reports that core application traffic appears healthy, but monitoring has flagged repeated authentication failures against a production MySQL instance.
GuardDuty has raised a HIGH finding for anomalous RDS login activity. The investigation package includes RDS authentication logs, database query activity, instance metadata, CloudWatch-style metrics, CloudTrail RDS API noise, and the GuardDuty finding.
Determine whether this is a brute-force attack, identify the targeted instance and database account, establish whether authentication succeeded, assess post-login activity, and recommend containment. Do not assume every failed login in the window is malicious.