<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Cloud Forensics Investigation

## AWS CloudTrail

```bash
# Lookup events by time range
aws cloudtrail lookup-events \
  --start-time "2026-03-15T00:00:00Z" \
  --end-time "2026-03-17T23:59:59Z" \
  --max-results 500

# Lookup by event name
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin

# Lookup by username
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=admin

# Lookup by resource
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::S3::Bucket
```

## AWS EC2 Forensic Snapshot

```bash
# Create snapshot
aws ec2 create-snapshot --volume-id vol-xxx --description "Forensic"

# Copy snapshot cross-account
aws ec2 modify-snapshot-attribute --snapshot-id snap-xxx \
  --attribute createVolumePermission --operation-type add --user-ids 123456789012

# Create volume from snapshot
aws ec2 create-volume --snapshot-id snap-xxx --availability-zone us-east-1a

# Attach to forensic workstation
aws ec2 attach-volume --volume-id vol-xxx --instance-id i-xxx --device /dev/sdf
```

## Azure CLI

```bash
# Activity log
az monitor activity-log list --start-time "2026-03-15" --output json

# Sign-in logs (Graph API)
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns"

# VM disk snapshot
az snapshot create --name forensic-snap --resource-group rg --source disk-id

# Export snapshot
az snapshot grant-access --name forensic-snap --resource-group rg \
  --duration-in-seconds 3600 --access-level read
```

## GCP gcloud

```bash
# Audit logs
gcloud logging read 'logName="projects/PROJECT/logs/cloudaudit.googleapis.com%2Factivity"' \
  --format=json --limit=500

# Disk snapshot
gcloud compute disks snapshot DISK --zone ZONE --snapshot-names forensic-snap

# Export to Cloud Storage
gcloud compute images export --image IMAGE \
  --destination-uri gs://bucket/image.tar.gz
```

## Docker Forensics

```bash
docker export <container_id> > filesystem.tar   # Full filesystem
docker logs <container_id> > logs.txt 2>&1       # Container logs
docker inspect <container_id> > metadata.json    # Configuration
docker diff <container_id> > changes.txt         # Modified files
docker cp <container_id>:/path ./local_copy/     # Extract files
```

## Kubernetes Forensics

```bash
kubectl logs <pod> --all-containers > pod_logs.txt
kubectl describe pod <pod> > pod_info.txt
kubectl get events --field-selector involvedObject.name=<pod>
kubectl cp <pod>:/var/log/ ./pod_logs/
kubectl debug <pod> -it --image=busybox --target=<container>
```

## Critical CloudTrail Events

| Event | Significance |
|-------|-------------|
| `ConsoleLogin` | Console access (check IP, MFA) |
| `CreateUser` | New IAM user (persistence) |
| `CreateAccessKey` | New API keys (persistence) |
| `AttachUserPolicy` | Permission escalation |
| `PutBucketPolicy` | S3 exposure/exfiltration |
| `StopLogging` | CloudTrail disabled (anti-forensics) |
| `RunInstances` | New compute (cryptomining) |
| `AuthorizeSecurityGroupIngress` | Firewall opened |
| `DeleteTrail` | Audit trail destruction |
