cloud-forensics

To investigate a cloud security breach, this Skill analyzes audit logs, IAM configurations, storage access patterns, and network flows across AWS and Azure. It maps detected unauthorized access and anomalies to MITRE ATT&CK Cloud techniques to generate a structured forensic report.

Collecting cloud audit logs for incident response requires provider-specific CLI tools and appropriate access permissions. The Skill uses these prerequisites to retrieve logs, review configurations, and analyze compute instance details for potential security compromises.

Yes, you can check IAM configurations for unauthorized access in GCP. The Skill performs comprehensive forensic checks across AWS, Azure, and GCP environments, reviewing IAM policies and storage access patterns to identify potential data exfiltration or threats.

Mapping security incidents to MITRE ATT&CK Cloud techniques helps identify known adversary behaviors during a cloud forensics investigation. This mapping contextualizes detected threats from audit logs and network flows, clarifying the specific tactics used in the security compromise.

Automating cloud forensics when suspicious activity is detected is best handled by using a Skill that automatically collects relevant logs, reviews IAM policies, and analyzes network flows. This generates a concise report detailing potential unauthorized access or data exfiltration across your cloud environments.