Tester script generates only one GuardDuty finding about amazon-guardduty-tester

[hirenshah005]

When I try to connect tester instance with ssh after setup step done on /.ssh/config I am getting
Enter passphrase for key '/root/.ssh/key.pem':
I don't have any passphrase setup here.

[tonyfruzza]

When I try to connect tester instance with ssh after setup step done on /.ssh/config I am getting
Enter passphrase for key '/root/.ssh/key.pem':
I don't have any passphrase setup here.

• Ensure that that key.pem the same ssh key associated with the EC2 instance.
• If unsure, generate a new EC2 SSH key in the AWS webconsole, save the key on your workstation in a safe place and chmod 600, relaunch the stack while setting the parameter in the cloudformation template to make use of the new key. Login using user ec2-user (since this is an amazon linux image you're logging into).

[tonyfruzza]

I've used the guardduty-tester.template for creating cloud formation stack and enabled guardduty on the same region. When I run $ ./guardduty_tester.sh from tester instance only Recon:EC2/Portscan finding is generated by guarduty. Is there any reason why other findings are not generated?

PS: I don't see any errors when running the script.

My account didn't have guardduty enabled for very long prior to this test and got 7 total. As GuardDuty is running longer it does build up a database of what it considers to be normal traffic and may be trained to believe some traffic is normal behavior.

[scottbward]

Closing this issue as it is nearly three years old and there is no actual issue identified that needs fixing. I will update the readme to indicate that the DNS related findings do take loner to generate and will show later than some of the other findings.