cloud-forensics

What problem does it solve?

This Skill enables security teams to conduct thorough cloud forensics across major platforms (AWS, Azure, GCP, and Microsoft 365) by systematically collecting, analyzing, and preserving evidence from cloud environments.

Core Features & Use Cases

• AWS Forensics: analyze CloudTrail, S3 access, IAM changes
• Azure Forensics: analyze Activity Logs, Sign-ins, resource changes
• GCP Forensics: analyze Cloud Audit Logs, IAM activity, data access
• M365 Forensics: Unified Audit Log, mailbox activity, SharePoint/OneDrive
• Timeline generation, evidence preservation, configuration analysis, data access tracking
• Use Case: incident response where cross-cloud evidence collection and timeline assembly are required

Quick Start

Start by initializing cloud forensics with your cloud credentials, then run AWS/Azure/GCP or M365 forensic workflows to fetch and analyze logs, build timelines, and generate reports.