skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

cloud-forensics

Analyze cloud forensic evidence across AWS, Azure, GCP, and M365.

5|Updated Jan 12, 2026
Search Tags:#timeline#log-analysis#incident-response#cloud-security#cross-cloud#cloud-forensics#evidence-preservation
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill cloud-forensics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cloud-forensics
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/forensics/cloud-forensics
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill cloud-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill enables security teams to conduct thorough cloud forensics across major platforms (AWS, Azure, GCP, and Microsoft 365) by systematically collecting, analyzing, and preserving evidence from cloud environments.

Core Features & Use Cases

  • AWS Forensics: analyze CloudTrail, S3 access, IAM changes
  • Azure Forensics: analyze Activity Logs, Sign-ins, resource changes
  • GCP Forensics: analyze Cloud Audit Logs, IAM activity, data access
  • M365 Forensics: Unified Audit Log, mailbox activity, SharePoint/OneDrive
  • Timeline generation, evidence preservation, configuration analysis, data access tracking
  • Use Case: incident response where cross-cloud evidence collection and timeline assembly are required

Quick Start

Start by initializing cloud forensics with your cloud credentials, then run AWS/Azure/GCP or M365 forensic workflows to fetch and analyze logs, build timelines, and generate reports.

Frequently Asked Questions about cloud-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze cloud logs across AWS, Azure, GCP, and M365 during an incident response?▼

Cross-cloud log analysis across AWS, Azure, GCP, and M365 is performed by initializing cloud credentials and running modular forensic workflows to fetch logs, build timelines, and generate structured reports for incident response.

What is the best way to preserve forensic evidence in a multi-cloud environment?▼

Cloud forensics evidence preservation is achieved by systematically collecting and analyzing logs and resource inventories from AWS, Azure, GCP, and M365 to support breach investigations and threat hunts.

Can I generate an incident timeline from CloudTrail and Azure Activity Logs?▼

Yes, timeline generation correlates data from AWS CloudTrail, Azure Activity Logs, GCP Cloud Audit Logs, and M365 Unified Audit Logs to assemble a structured chronological view for breach investigations.

Does this approach support tracking IAM changes and data access in GCP?▼

Yes, GCP forensics supports analyzing Cloud Audit Logs to track IAM activity and data access, alongside AWS IAM changes and M365 mailbox or SharePoint activity tracking.

How do I track mailbox and SharePoint activity in Microsoft 365 for a breach investigation?▼

M365 forensics analyzes the Unified Audit Log to track mailbox activity and SharePoint/OneDrive data access, feeding the data into timeline generation and structured reporting for breach investigations.

Related Skills

Explore More Data & Analytics Skills→
balsm-healthbalsm-health
2

conducting-cloud-incident-response

Automate AWS, Azure, and GCP incident response workflows including containment and evidence collection.

Official
Advanced
kiwamizamuraikiwamizamurai
7

forensics

Extract hidden data and forensic artifacts from files using standard tools.

Community
Advanced
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced
ArdurAIArdurAI
1

god-security-cloud

Audit AWS, Azure, and GCP configurations for security misconfigurations.

Official
Advanced