cloud-logging-baseline
Skill0 starsChanged 11 days agoMITView on GitHub
Define and verify the minimum security logging baseline for AWS, Azure, GCP and major SaaS — what to enable (control plane, data events, identity, network, DNS, Kubernetes), retention, immutability and SIEM forwarding — and find gaps before an incident. Use when onboarding cloud environments, preparing for IR readiness, or after an investigation was blocked by missing logs.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Cloud Logging Baseline
AWS
| Log | Enable | Verify |
| CloudTrail org trail, multi-region, log file validation | Yes | aws cloudtrail describe-trails --query 'trailList[].{n:Name,multi:IsMultiRegionTrail,org:IsOrganizationTrail,validation:LogFileValidationEnabled}' |
| CloudTrail data events (S3 sensitive buckets, Lambda) | Selectively (cost) | aws cloudtrail get-event-selectors --trail-name T |
| VPC Flow Logs | All VPCs | aws ec2 describe-flow-logs |
| Route 53 Resolver query logs | Yes | aws route53resolver list-resolver-query-log-configs |
| GuardDuty (all regions, org) | Yes | aws guardduty list-detectors per region |
| EKS control-plane audit | Yes | eks-* |
| Config | Yes | aws configservice describe-configuration-recorder-status |
Azure / Entra
Entra ID sign-in (interactive, non-interactive, service principal, managed identity) and audit logs → Log Analytics/Sentinel (portal retention is short); Azure Activity Log via diagnostic settings at subscription/management group; resource diagnostic logs (Key Vault, Storage, SQL, AKS kube-audit, NSG/VNet flow logs); Microsoft Defender XDR streaming; M365 Unified Audit Log (Purview Audit Standard/Premium retention).
az monitor diagnostic-settings subscription list --query "value[].{name:name,ws:workspaceId}"GCP
Admin Activity (always on), Data Access logs (off by default except BigQuery — enable for sensitive services), System Event, Policy Denied; VPC Flow Logs per subnet; Cloud DNS logging; organization-level aggregated sink to a locked bucket/BigQuery.
gcloud logging sinks list --organization=ORG_ID
gcloud projects get-iam-policy PROJECT --format=json | jq '.auditConfigs'SaaS
Okta System Log, Google Workspace audit, GitHub audit log streaming, Salesforce Event Monitoring, Slack audit logs (Enterprise) — via API to SIEM.
Retention & integrity
Minimum 1 year (≥ 90 days hot) is common guidance; check regulatory needs (PCI DSS 10.5.1: 12 months, 3 immediately available). Store in a separate log account/subscription/project with restricted delete (S3 Object Lock, immutable blob storage, locked GCS retention policies).
Gap report
Environment | Log source | Required | Enabled | Retention | Forwarded to SIEM | Gap | Owner
Related skills
log-source-onboarding, aws-org-guardrails, cloud-incident-response, hunt-data-readiness
References
- NSA/CISA Best Practices for Event Logging and Threat Detection: https://www.cisa.gov/resources-tools/resources/best-practices-event-logging-and-threat-detection
- AWS security logging guidance (SRA): https://docs.aws.amazon.com/prescriptive-guidance/latest/security-reference-architecture/log-archive.html
- Microsoft Entra monitoring and health: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/
- GCP Cloud Audit Logs: https://cloud.google.com/logging/docs/audit
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.