.

compliance/auditing/audit-logging/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: audit-logging
+description: Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when implementing audit trail requirements.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Audit Logging
+
+Implement comprehensive audit logging for compliance.
+
+## Log Categories
+
+```yaml
+audit_events:
+  authentication:
+    - Login attempts
+    - MFA events
+    - Session management
+    
+  authorization:
+    - Access grants
+    - Permission changes
+    - Role assignments
+    
+  data_access:
+    - Read operations
+    - Write operations
+    - Delete operations
+    
+  administrative:
+    - Configuration changes
+    - User management
+    - System changes
+```
+
+## Application Logging
+
+```python
+import logging
+import json
+
+class AuditLogger:
+    def log_event(self, event_type, user, resource, action, result):
+        log_entry = {
+            'timestamp': datetime.utcnow().isoformat(),
+            'event_type': event_type,
+            'user': user,
+            'resource': resource,
+            'action': action,
+            'result': result,
+            'source_ip': request.remote_addr
+        }
+        logger.info(json.dumps(log_entry))
+```
+
+## Centralized Logging
+
+```yaml
+# Fluentd configuration
+<source>
+  @type tail
+  path /var/log/audit/*.log
+  tag audit.*
+</source>
+
+<match audit.**>
+  @type elasticsearch
+  host elasticsearch.example.com
+  index_name audit-logs
+</match>
+```
+
+## Best Practices
+
+- Structured logging (JSON)
+- Centralized collection
+- Tamper-proof storage
+- Retention policies
+- Alerting on anomalies

compliance/auditing/aws-cloudtrail/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: aws-cloudtrail
+description: Configure AWS CloudTrail for audit logging. Set up organization trails and event analysis. Use when auditing AWS activity.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# AWS CloudTrail
+
+Audit AWS account activity with CloudTrail.
+
+## Create Trail
+
+```bash
+# Create organization trail
+aws cloudtrail create-trail \
+  --name org-audit-trail \
+  --s3-bucket-name audit-logs-bucket \
+  --is-organization-trail \
+  --is-multi-region-trail \
+  --enable-log-file-validation \
+  --kms-key-id arn:aws:kms:...
+
+# Start logging
+aws cloudtrail start-logging --name org-audit-trail
+```
+
+## Event Selectors
+
+```bash
+# Log all management and data events
+aws cloudtrail put-event-selectors \
+  --trail-name org-audit-trail \
+  --event-selectors '[{
+    "ReadWriteType": "All",
+    "IncludeManagementEvents": true,
+    "DataResources": [{
+      "Type": "AWS::S3::Object",
+      "Values": ["arn:aws:s3:::sensitive-bucket/"]
+    }]
+  }]'
+```
+
+## CloudTrail Lake
+
+```sql
+-- Query events
+SELECT eventTime, userIdentity.userName, eventName, sourceIPAddress
+FROM cloudtrail_logs
+WHERE eventTime > '2024-01-01'
+  AND eventName LIKE '%Delete%'
+ORDER BY eventTime DESC
+LIMIT 100
+```
+
+## Best Practices
+
+- Organization-wide trails
+- Enable log file validation
+- Encrypt with KMS
+- CloudWatch Logs integration
+- Event alerting

compliance/auditing/azure-monitor-audit/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: azure-monitor-audit
+description: Configure Azure Monitor and Activity Log for auditing. Set up diagnostic settings and log analytics. Use when auditing Azure activity.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Azure Monitor Audit
+
+Audit Azure activity with Monitor and Activity Logs.
+
+## Diagnostic Settings
+
+```bash
+# Enable diagnostic settings
+az monitor diagnostic-settings create \
+  --name audit-logs \
+  --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/... \
+  --logs '[{"category":"AuditEvent","enabled":true}]' \
+  --workspace /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}
+```
+
+## Activity Log Export
+
+```bash
+# Export activity log to Log Analytics
+az monitor diagnostic-settings subscription create \
+  --name activity-log-export \
+  --location global \
+  --logs '[{"category":"Administrative","enabled":true},{"category":"Security","enabled":true}]' \
+  --workspace /subscriptions/.../workspaces/audit-workspace
+```
+
+## Log Analytics Queries
+
+```kusto
+// Failed login attempts
+AuditLogs
+| where TimeGenerated > ago(24h)
+| where ResultType != "0"
+| project TimeGenerated, Identity, ResultDescription, IPAddress
+
+// Administrative changes
+AzureActivity
+| where CategoryValue == "Administrative"
+| where OperationNameValue contains "write" or OperationNameValue contains "delete"
+| project TimeGenerated, Caller, OperationNameValue, ResourceGroup
+```
+
+## Best Practices
+
+- Centralize to Log Analytics
+- Long-term archive to Storage
+- Configure alerts
+- Regular query reviews

compliance/auditing/gcp-audit-logs/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: gcp-audit-logs
+description: Configure GCP Cloud Audit Logs for compliance. Set up log routing and BigQuery analysis. Use when auditing GCP activity.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# GCP Audit Logs
+
+Audit GCP activity with Cloud Audit Logs.
+
+## Audit Log Types
+
+```yaml
+log_types:
+  admin_activity:
+    - Always enabled
+    - API calls that modify resources
+    - No charge
+    
+  data_access:
+    - Must be enabled
+    - Read/write data operations
+    - Can be high volume
+    
+  system_event:
+    - Always enabled
+    - GCP system actions
+    
+  policy_denied:
+    - Always enabled
+    - Access denials
+```
+
+## Enable Data Access Logs
+
+```bash
+# Enable for all services
+gcloud logging sinks create audit-sink \
+  storage.googleapis.com/audit-logs-bucket \
+  --log-filter='logName:"cloudaudit.googleapis.com"'
+
+# IAM policy for data access logs
+gcloud projects get-iam-policy PROJECT_ID > policy.yaml
+# Add auditConfigs section
+gcloud projects set-iam-policy PROJECT_ID policy.yaml
+```
+
+## BigQuery Analysis
+
+```sql
+-- Query audit logs from BigQuery export
+SELECT
+  timestamp,
+  protopayload_auditlog.authenticationInfo.principalEmail,
+  protopayload_auditlog.methodName,
+  resource.labels.project_id
+FROM `project.dataset.cloudaudit_googleapis_com_activity_*`
+WHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
+  AND protopayload_auditlog.methodName LIKE '%delete%'
+ORDER BY timestamp DESC
+```
+
+## Best Practices
+
+- Export to BigQuery for analysis
+- Configure log retention
+- Enable data access logs for sensitive resources
+- Set up alerting policies