CloudWatch: Status: Success & Code: 200 YET Message: Connection closed early

Hi everyone,

new to CloudWatch log insights. Trying to make sense out of this.

responseStatus.code: 200
responseStatus.message: Connection closed early response
Status.status: Success

How is it possible for the connection to be successful and the connection to be closed early?

When googling this issue, nothing came up.

Side question: is there a way to query for Ports and/or Protocol? I have an alert from Guard Duty that I have been bending over backwards to find out in the logs but none of the logs from that time period in CloudWatch mentions any Port or Protocol, both of which was the cause of the alert. Does anybody know where I can get more info besides using Detective?

Thank you.