You can use GuardDuty to monitor and detect suspicious behavior in your AWS environment. Consider this example that uses GuardDuty to troubleshoot an EC2 instance under an SSH brute force attack with a security group that allows SSH access from sources over the internet.

3. From the

EC2 console, choose Security Groups, choose a security group, and then choose the Inbound tab.

4. In the navigation pane, choose Instances, and then open the instances pane in a new tab.

5. Select your instance, and then copy the Instance ID.

6. From the GuardDuty console

, choose Add filter criteria, and then choose Instance ID.

7. Paste the Instance ID into the search box, and then choose Apply.

8. In Finding Type, choose the most recent findings as noted in the Last seen column.

9. Scroll to the Actor section, and then copy the source IP address

of the attack.

10. Open the terminal on the EC2 Linux instance, open the /var/log/secure directory, and then open the secure file.
Note: The secure file contains the SSH login.

11. Enter the source IP address from step 9.
Note: Amazon Linux AMI SSH logs contain all the authentication attempts to connect to the instance.

12. Open the AWS Config console, choose Rules, choose Add rule, and then enter restricted in the search box.

13. Choose restricted-ssh, and then choose Save.

Note: The restricted-ssh rule checks for security groups that disallow unrestricted incoming SSH traffic.

14. In Rule name under the Compliance field, wait for the restricted-ssh rule to change from Evaluating to noncompliant resource(s). You can also choose the refresh icon.

15. Choose restricted-ssh to view the non-compliant security groups.

16. In Manage resource, choose a non-compliant security group, and then choose the Inbound tab.

In this example, the security group is non-compliant because it allows SSH connections from all sources. To restrict SSH traffic, see Adding a Rule for Inbound SSH Traffic to a Linux Instance.