performing-cloud-forensics-investigation

What problem does it solve?

Cloud environments generate vast logs, snapshots, and IAM activity data that are difficult to unify during investigations. This Skill automates the collection and analysis of cloud-forensics evidence across AWS, Azure, and GCP to accelerate incident response.

Core Features & Use Cases

• Collect CloudTrail, Azure Activity/Audit Logs, and GCP Cloud Logging to map attacker activity across providers.
• Create forensic snapshots of EC2 disks and VM images for preservation and later analysis.
• Analyze IAM credential usage, identify suspicious actions, and summarize findings for reporting.
• Generate structured incident response artifacts (evidence inventory, findings, and a concise report) for multi-cloud investigations.

Quick Start

Run the cloud-forensics agent to start collecting evidence from your AWS, Azure, and GCP environments.