<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Cloud Forensics

## AWS CLI — CloudTrail

```bash
# Lookup events by time range
aws cloudtrail lookup-events \
  --start-time "2026-03-10T00:00:00Z" \
  --end-time "2026-03-17T23:59:59Z" \
  --max-results 1000 --output json

# Filter by username
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=target-user

# Filter by event name
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin
```

| Attribute Key | Description |
|---------------|-------------|
| `EventId` | Unique event identifier |
| `EventName` | API action name |
| `Username` | IAM user or role |
| `ResourceType` | AWS resource type |
| `ResourceName` | Resource ARN or name |
| `EventSource` | AWS service (e.g., s3.amazonaws.com) |

## AWS CLI — EBS Snapshots

```bash
# Create forensic snapshot
aws ec2 create-snapshot --volume-id vol-xxx --description "Forensic"

# Copy to forensic account
aws ec2 copy-snapshot --source-region us-east-1 --source-snapshot-id snap-xxx

# Create volume from snapshot
aws ec2 create-volume --snapshot-id snap-xxx --availability-zone us-east-1a

# Share snapshot with forensic account
aws ec2 modify-snapshot-attribute --snapshot-id snap-xxx \
  --attribute createVolumePermission --operation-type add \
  --user-ids 123456789012
```

## AWS CLI — VPC Flow Logs

```bash
# CloudWatch Insights query
aws logs start-query --log-group-name "vpc-flow-logs" \
  --start-time EPOCH --end-time EPOCH \
  --query-string 'fields @timestamp, srcAddr, dstAddr, dstPort, action
    | filter action = "REJECT" | stats count(*) by srcAddr'

# Get query results
aws logs get-query-results --query-id "query-id-xxx"
```

## Azure CLI

```bash
# Activity log
az monitor activity-log list --start-time "2026-03-10" --output json

# Sign-in logs (Graph API)
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns"

# Create managed disk snapshot
az snapshot create --resource-group RG --name forensic-snap \
  --source /subscriptions/.../disks/target-disk
```

## GCP — gcloud

```bash
# Audit logs
gcloud logging read 'logName="projects/PROJECT/logs/cloudaudit.googleapis.com"' \
  --freshness=7d --format=json

# Disk snapshot
gcloud compute disks snapshot DISK --zone=us-central1-a \
  --snapshot-names=forensic-snap

# Export snapshot to GCS
gcloud compute images export --destination-uri gs://bucket/image.tar.gz \
  --source-disk DISK --source-disk-zone us-central1-a
```

## Docker — Container Forensics

```bash
docker inspect <id>           # Full container metadata
docker logs <id> --timestamps # Container logs with timestamps
docker diff <id>              # Filesystem changes (A/C/D)
docker export <id> -o fs.tar  # Export filesystem as tar
docker cp <id>:/path ./local  # Copy specific files
```

## libcloudforensics

```python
from libcloudforensics.providers.aws import forensics as aws_forensics

# Create forensic copy of EBS volume
snapshot = aws_forensics.CreateVolumeCopy(
    'us-east-1', instance_id='i-xxx', volume_id='vol-xxx'
)
```
