cloud-incident-response
Skill0 starsChanged 11 days agoMITView on GitHub
Lead incident response in AWS, Azure or GCP — preserve control-plane and data-plane logs, identify compromised identities and resources, contain via identity and network controls, collect forensic snapshots, and recover — with provider-specific commands. Use when a cloud account, subscription, tenant or project is compromised or a cloud workload is breached.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Cloud Incident Response
Phases mapped to providers
| Step | AWS | Azure | GCP |
| Control-plane logs | CloudTrail (all regions), Organization trail | Activity Log, Entra ID sign-in/audit logs | Cloud Audit Logs (Admin Activity, Data Access) |
| Data-plane logs | S3 data events, VPC Flow Logs, Route 53 Resolver | Storage logs, NSG/VNet flow logs, Key Vault logs | Data Access logs, VPC Flow Logs, Cloud DNS |
| Threat detection | GuardDuty, Security Hub, Detective | Defender for Cloud, Sentinel | Security Command Center |
| Contain identity | Deactivate keys, revoke sessions (aws-credential-compromise) | Disable user, Revoke-MgUserSignInSession, remove role assignments | Disable SA/keys, remove IAM bindings, revoke OAuth tokens |
| Contain network | Isolation security group, NACL | NSG deny-all on NIC | Firewall rule deny / remove external IP |
| Forensic copy | EBS snapshot → forensic account | Managed disk snapshot → forensic subscription | PD snapshot → forensic project |
Workflow
- Preserve first: export relevant logs before retention windows expire (CloudTrail Event history 90 days; Azure Activity Log 90 days by default; Entra sign-in logs 7–30 days depending on licence unless exported).
- Identify the initial principal and trace every identity it created or assumed (role chains, service principals, service accounts, federated trusts).
- Inventory attacker changes: new identities/keys, policy changes, compute launched (check all regions), network changes, data shares (snapshots/images shared to external accounts), logging tampering.
- Contain in a coordinated window (
containment-plan), prioritizing identity: rotate/revoke, then remove persistence. - Forensics on workloads: snapshot disks, memory capture where feasible, isolate rather than terminate.
- Recover: redeploy from IaC, rotate secrets, re-enable logging and guardrails, monitor for re-entry.
- Report: timeline, data accessed, root cause (leaked keys, misconfig, SSRF, phished admin).
Cloud-specific pitfalls
- Terminating instances destroys evidence (instance store, memory).
- Attacker-created identities in other accounts/tenants via trust relationships.
- Billing anomalies (cryptomining) often first signal — check all regions.
- Provider may also need a support case (account restrictions, abuse notices).
Related skills
aws-credential-compromise, entra-signin-investigation, gcp-audit-log-investigation, forensic-imaging, cloud-logging-baseline
References
- AWS Security Incident Response Guide: https://docs.aws.amazon.com/security-ir/latest/userguide/
- Microsoft incident response playbooks: https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks
- Google Cloud data incident response process: https://cloud.google.com/docs/security/incident-response
- Invictus IR cloud cheat sheets: https://github.com/invictus-ir
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.