# AWS — Security Hub + CIS Benchmark
aws securityhub get-findings --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}'

# AWS — IAM Access Analyzer (find public/cross-account access)
aws accessanalyzer list-findings --analyzer-arn $ANALYZER_ARN

# AWS — Config compliance
aws configservice get-compliance-summary-by-config-rule

# Prowler (multi-cloud CSPM)
prowler aws --compliance cis_2.0
prowler azure --compliance cis_2.0
prowler gcp --compliance cis_2.0

# ScoutSuite (multi-cloud audit)
scout aws --report-dir ./report/

# AWS — Find overprivileged IAM users/roles
aws iam generate-credential-report
aws iam get-credential-report --output text --query Content | base64 -d

# Find users with console access + no MFA
aws iam list-users | jq -r '.Users[].UserName' | while read user; do
  MFA=$(aws iam list-mfa-devices --user-name "$user" | jq '.MFADevices | length')
  [ "$MFA" -eq 0 ] && echo "NO MFA: $user"
done

# Find inline policies (should use managed policies)
aws iam list-users | jq -r '.Users[].UserName' | while read user; do
  INLINE=$(aws iam list-user-policies --user-name "$user" | jq '.PolicyNames | length')
  [ "$INLINE" -gt 0 ] && echo "INLINE POLICY: $user ($INLINE policies)"
done

# Find unused access keys (>90 days)
aws iam list-users | jq -r '.Users[].UserName' | while read user; do
  aws iam list-access-keys --user-name "$user" | jq -r '.AccessKeyMetadata[] |
    select(.Status=="Active") | "\(.UserName): \(.AccessKeyId) created \(.CreateDate)"'
done

# Azure — PIM eligible vs active assignments
az role assignment list --all --output table

# AWS — Verify CloudTrail in all regions
aws cloudtrail describe-trails | jq '.trailList[] | {Name, IsMultiRegionTrail, LogFileValidationEnabled}'

# AWS — GuardDuty findings
aws guardduty list-findings --detector-id $DETECTOR_ID --finding-criteria \
  '{"Criterion":{"severity":{"Gte":7}}}'

# Azure — Diagnostic settings for key resources
az monitor diagnostic-settings list --resource $RESOURCE_ID

# GCP — Verify audit logs enabled
gcloud logging sinks list
gcloud projects get-iam-policy $PROJECT_ID

# Critical logs to centralize:
# AWS: CloudTrail, VPC Flow Logs, GuardDuty, Config, WAF, ALB access logs
# Azure: Activity Log, Sign-in Logs, Diagnostic Settings, NSG Flow Logs
# GCP: Audit Logs, VPC Flow Logs, Cloud Armor, Load Balancer logs

# AWS — Find security groups with 0.0.0.0/0 ingress
aws ec2 describe-security-groups --filters "Name=ip-permission.cidr,Values=0.0.0.0/0" \
  --query 'SecurityGroups[].{ID:GroupId,Name:GroupName}' --output table

# AWS — Find public S3 buckets
aws s3api list-buckets | jq -r '.Buckets[].Name' | while read bucket; do
  ACL=$(aws s3api get-bucket-acl --bucket "$bucket" 2>/dev/null | jq -r '.Grants[] | select(.Grantee.URI != null) | .Grantee.URI')
  [ -n "$ACL" ] && echo "PUBLIC: $bucket — $ACL"
done

# Azure — Find NSGs with any/any rules
az network nsg list | jq '.[] | select(.securityRules[] | select(.sourceAddressPrefix=="*" and .access=="Allow"))'

# AWS — Snapshot compromised EC2 for forensics
aws ec2 create-snapshot --volume-id $VOL_ID --description "IR forensics $(date +%Y%m%d)"

# AWS — CloudTrail query for specific actor
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
  --start-time "2026-03-01T00:00:00Z" --max-results 50

# AWS — Isolate compromised instance
aws ec2 modify-instance-attribute --instance-id $INSTANCE_ID --groups $ISOLATION_SG_ID