skills.rest
YukiIto1999
YukiIto1999COMMUNITY
Explore all skills by this author →
GitHub

performing-cloud-forensics-investigation

Automate collection and analysis of logs, snapshots, and IAM activity across AWS, Azure, and GCP.

Updated Apr 23, 2026
Search Tags:#multi-cloud#log-analysis#incident-response#cloud-forensics#cloudtrail#forensic-snapshots#iam-activity
One-click install
npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-forensics-investigation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-cloud-forensics-investigation
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/performing-cloud-forensics-investigation
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill performing-cloud-forensics-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, botocore, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Cloud environments generate vast logs, snapshots, and IAM activity data that are difficult to unify during investigations. This Skill automates the collection and analysis of cloud-forensics evidence across AWS, Azure, and GCP to accelerate incident response.

Core Features & Use Cases

  • Collect CloudTrail, Azure Activity/Audit Logs, and GCP Cloud Logging to map attacker activity across providers.
  • Create forensic snapshots of EC2 disks and VM images for preservation and later analysis.
  • Analyze IAM credential usage, identify suspicious actions, and summarize findings for reporting.
  • Generate structured incident response artifacts (evidence inventory, findings, and a concise report) for multi-cloud investigations.

Quick Start

Run the cloud-forensics agent to start collecting evidence from your AWS, Azure, and GCP environments.

Frequently Asked Questions about performing-cloud-forensics-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate multi-cloud log collection for incident response across AWS, Azure, and GCP?▼

You can automate multi-cloud log collection by running a CLI-based agent that gathers CloudTrail, Azure Activity Logs, and GCP Cloud Logging data to map attacker activity across providers for incident response.

What is the best way to preserve EC2 disks and VM images as forensic snapshots during a security investigation?▼

The best way to preserve forensic snapshots is to automate the creation of EC2 disk and VM image snapshots, ensuring evidence is secured for later analysis during post-incident audits.

Can I analyze suspicious IAM credential usage across multiple cloud providers in one workflow?▼

Yes, you can analyze suspicious IAM credential usage across AWS, Azure, and GCP within a single CLI-based agent workflow that identifies anomalous actions and summarizes findings for reporting.

Does this cloud forensics approach require specific dependencies to run?▼

Yes, this cloud forensics approach requires installing boto3 and botocore dependencies to interact with cloud APIs and automate the collection of cross-cloud evidence.

What artifacts do I get from a cross-cloud forensics investigation?▼

You receive structured incident response artifacts including a complete evidence inventory, detailed findings of suspicious activity, and a concise report summarizing the multi-cloud investigation.

When do I need to use automated forensic snapshots for cloud security?▼

You need automated forensic snapshots when responding to security incidents or conducting post-incident audits that require strict evidence preservation of disk states and VM images across cloud environments.

Related Skills

Explore More Data & Analytics Skills→
robit-manrobit-man

cloud-forensics

Investigate AWS, Azure, and GCP environments for security compromises and map findings to MITRE ATT&CK Cloud techniques.

Community
Advanced
daemon-blockint-techdaemon-blockint-tech
7

incident-responder

Automate CSIRT-style incident response workflows with evidence handling and regulatory preparation.

Community
Advanced
refractionPOINTrefractionPOINT
29

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

Official
Advanced
jmaglyjmagly
175

cloud-forensics

Investigate AWS, Azure, and GCP environments for security compromises.

Community
Advanced