<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-audit-evidence-automation
description: >-
  Automate audit evidence collection, organization, and validation across
  multiple compliance frameworks. Build pipelines that gather system
  configurations, access logs, change records, and policy documents into
  structured evidence packages with cryptographic integrity verification.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - audit-evidence
  - evidence-automation
  - evidence-collection
  - compliance
  - hashing
  - chain-of-custody
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Audit Evidence Automation

## Overview

Manual evidence collection is the largest time cost in compliance audits. This
skill automates the gathering of system configurations, access logs, policy
documents, change records, and control test results into structured evidence
packages. Each artifact is hashed for integrity and mapped to specific control
requirements across frameworks (PCI DSS, SOC 2, HIPAA, ISO 27001).

Mode: `[MODE: BLUE]` — Automated evidence pipeline with integrity assurance.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |
| sha256sum | Standard on Linux |
| AWS CLI | For cloud evidence collection |
| Git | For change evidence |

## Key Concepts

### Evidence Collection Architecture

```
Evidence Sources:
├── System Configuration
│   ├── /etc/passwd, /etc/shadow permissions
│   ├── sshd_config, pam.d settings
│   ├── firewall rules (iptables/nftables)
│   └── Service configurations
├── Access Logs
│   ├── auth.log / secure log
│   ├── Cloud IAM access logs
│   ├── Application audit trails
│   └── VPN connection logs
├── Change Records
│   ├── Git commit history
│   ├── CI/CD deployment logs
│   ├── Ticket system exports
│   └── Configuration drift reports
├── Policy Documents
│   ├── Information security policy
│   ├── Acceptable use policy
│   ├── Incident response plan
│   └── Business continuity plan
└── Control Test Results
    ├── InSpec scan reports
    ├── Vulnerability scan results
    ├── Penetration test reports
    └── Access review attestations
         │
         ▼
    ┌─────────────────┐
    │ Evidence Package │
    │ • SHA-256 hashes │
    │ • Control mapping │
    │ • Collection time │
    │ • Collector ID    │
    └─────────────────┘
```

### Evidence Artifact Structure

```json
{
  "artifact_id": "EVD-2026-001",
  "title": "SSH Configuration — Production Server",
  "collected_at": "2026-03-01T10:30:00Z",
  "collector": "automated-pipeline",
  "source": "prod-web-01:/etc/ssh/sshd_config",
  "sha256": "a3f2b1c4d5e6f7890123456789abcdef0123456789abcdef0123456789abcdef",
  "controls_mapped": [
    {"framework": "PCI DSS", "control": "2.2.1"},
    {"framework": "NIST 800-53", "control": "CM-6"},
    {"framework": "SOC 2", "control": "CC6.1"},
    {"framework": "ISO 27001", "control": "A.8.9"}
  ],
  "content_type": "text/plain",
  "retention_until": "2029-03-01"
}
```

### Collection Commands

```bash
# System configuration evidence
sshd -T > /tmp/evidence/sshd_config_$(date +%Y%m%d).txt
iptables -L -n -v > /tmp/evidence/iptables_$(date +%Y%m%d).txt
cat /etc/login.defs > /tmp/evidence/login_defs_$(date +%Y%m%d).txt

# Hash all evidence files
find /tmp/evidence/ -type f -exec sha256sum {} \; > /tmp/evidence/manifest.sha256

# Verify evidence integrity
sha256sum -c /tmp/evidence/manifest.sha256

# Access log collection
journalctl -u sshd --since "30 days ago" --output json > /tmp/evidence/ssh_access.json

# AWS CloudTrail evidence
aws cloudtrail lookup-events --start-time "2026-01-01" --end-time "2026-03-01" \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --output json > /tmp/evidence/console_logins.json

# Git change evidence
git log --since="3 months ago" --format='{"hash":"%H","author":"%an","date":"%aI","message":"%s"}' \
  > /tmp/evidence/git_changes.jsonl
```

## Workflow

### Step 1: Initialize Evidence Collection

```bash
node scripts/agent.js --action collect --sources system,access,changes \
  --output-dir /tmp/evidence/ --output /tmp/evidence-manifest.json
```

### Step 2: Map Evidence to Controls

```bash
node scripts/agent.js --action map --evidence-dir /tmp/evidence/ \
  --frameworks pci-dss,soc2,iso27001 --output /tmp/evidence-map.json
```

### Step 3: Generate Evidence Package

```bash
node scripts/agent.js --action package --manifest /tmp/evidence-manifest.json \
  --output /tmp/evidence-package.json
```

## Verification

- [ ] All evidence artifacts hashed with SHA-256
- [ ] Manifest file validates against collected artifacts
- [ ] Each artifact mapped to at least one control requirement
- [ ] Collection timestamps recorded in UTC
- [ ] Evidence retention periods assigned per regulatory requirement
- [ ] Chain-of-custody metadata captured (collector, source, method)

## References

- [ISACA IT Audit Evidence](https://www.isaca.org/)
- [AICPA Audit Evidence Standards](https://www.aicpa.org/)
- [NIST SP 800-53A Assessment Procedures](https://csrc.nist.gov/)
- [ISO 19011 Auditing Guidelines](https://www.iso.org/standard/70017.html)
