Security Posture Management

# Enable Security Hub
aws securityhub enable-security-hub \
  --enable-default-standards

# Enable specific compliance standards
aws securityhub batch-enable-standards --standards-subscription-requests '[
  {"StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/3.0.0"},
  {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/nist-800-53/v/5.0.0"},
  {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"}
]'

# View findings summary
aws securityhub get-findings \
  --filters '{"SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}]}' \
  --max-items 10 \
  --query 'Findings[].{Title:Title,Resource:Resources[0].Id,Severity:Severity.Label}' \
  --output table

# Get compliance status
aws securityhub get-insight-results \
  --insight-arn "arn:aws:securityhub:::insight/securityhub/default/1"

# Enable GuardDuty for threat detection
aws guardduty create-detector --enable

# Enable Inspector for vulnerability scanning
aws inspector2 enable --resource-types EC2 ECR LAMBDA

# Create an automated action (remediate public S3 buckets)
aws securityhub create-action-target \
  --name "RemediatePublicS3" \
  --description "Block public access on S3 buckets" \
  --id "RemediatePublicS3"

# Check Defender for Cloud status
az security pricing list --output table

# Enable Defender for specific resource types
az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name SqlServers --tier Standard
az security pricing create --name Containers --tier Standard
az security pricing create --name StorageAccounts --tier Standard

# View secure score
az security secure-score list --output table

# List security recommendations
az security assessment list \
  --output table \
  --query "[?status.code=='Unhealthy'].{Name:displayName,Status:status.code,Severity:metadata.severity}"

# View compliance assessment
az security regulatory-compliance-standards list \
  --output table

# Get details for a specific standard
az security regulatory-compliance-controls list \
  --standard-name "CIS-Microsoft-Azure-Foundations-Benchmark-v2.0.0" \
  --output table \
  --query "[?state=='Failed'].{Control:id,Description:description}"

# Enable multi-cloud connector for AWS
az security connector create \
  --name aws-connector \
  --resource-group security-rg \
  --environment-name AWS \
  --hierarchy-identifier AWS_ACCOUNT_ID \
  --offerings "[{offeringType:CspmMonitorAws}]"

# List security alerts
az security alert list \
  --output table \
  --query "[].{Name:alertDisplayName,Severity:severity,Status:status}"

# Enable Security Command Center API
gcloud services enable securitycenter.googleapis.com

# List active findings (high severity)
gcloud scc findings list organizations/ORG_ID \
  --filter='severity="HIGH" AND state="ACTIVE"' \
  --format="table(finding.category,finding.severity,finding.resourceName,finding.description)" \
  --limit=20

# List misconfiguration findings
gcloud scc findings list organizations/ORG_ID \
  --source=organizations/ORG_ID/sources/SECURITY_HEALTH_ANALYTICS_SOURCE_ID \
  --filter='state="ACTIVE"' \
  --format="table(finding.category,finding.severity,finding.resourceName)"

# Mute a finding (known false positive)
gcloud scc findings set-mute \
  organizations/ORG_ID/sources/SOURCE_ID/findings/FINDING_ID \
  --mute=MUTED

# Create a mute rule (suppress known patterns)
gcloud scc muteconfigs create \
  --organization=ORG_ID \
  --mute-config-id=mute-dev-findings \
  --filter='resource.projectDisplayName="dev-project"' \
  --description="Suppress findings from dev project"

# Export findings to BigQuery for analysis
gcloud scc findings list organizations/ORG_ID \
  --filter='state="ACTIVE"' \
  --format=json > scc-findings.json

# Enable Event Threat Detection (Premium)
# Detects: cryptomining, malware, brute force, data exfiltration

# Set up notifications via Pub/Sub
gcloud scc notifications create scc-critical-alerts \
  --organization=ORG_ID \
  --pubsub-topic=projects/MY_PROJECT/topics/scc-alerts \
  --filter='severity="CRITICAL" AND state="ACTIVE"'

# Enable Cloud Guard
oci cloud-guard cloud-guard-configuration update \
  --reporting-region us-ashburn-1 \
  --status ENABLED

# Create a target (scope of monitoring)
oci cloud-guard target create \
  --compartment-id TENANCY_OCID \
  --display-name "production-guard" \
  --target-resource-id COMPARTMENT_OCID \
  --target-resource-type COMPARTMENT \
  --description "Monitor production compartment"

# List active problems
oci cloud-guard problem list \
  --compartment-id TENANCY_OCID \
  --lifecycle-state ACTIVE \
  --risk-level CRITICAL \
  --output table \
  --query "data[].{Name:"detector-rule-id",Resource:"resource-name",Risk:"risk-level"}"

# List detector recipes (built-in detection rules)
oci cloud-guard detector-recipe list \
  --compartment-id TENANCY_OCID \
  --output table

# Create a responder recipe for auto-remediation
oci cloud-guard responder-recipe list \
  --compartment-id TENANCY_OCID \
  --output table

# Resolve a problem
oci cloud-guard problem update-problem \
  --problem-id PROBLEM_OCID \
  --lifecycle-detail RESOLVED \
  --comment "Fixed: disabled public access on bucket"

# Prowler: Open-source security assessment across clouds

# Install Prowler
pip install prowler

# Run AWS security assessment
prowler aws --compliance cis_2.0_aws

# Run Azure security assessment
prowler azure --compliance cis_2.1_azure

# Run GCP security assessment
prowler gcp --compliance cis_2.0_gcp

# Generate HTML report
prowler aws --output-formats html --output-directory ./reports/

# Run specific checks only
prowler aws --checks s3_bucket_public_access iam_root_mfa_enabled \
  ec2_security_group_default_restrict_traffic