<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Audit Evidence Automation — API Reference

## Evidence Collection Commands

```bash
# System configuration evidence
sshd -T > evidence/sshd_config.txt
iptables -L -n -v > evidence/iptables.txt
cat /etc/login.defs > evidence/login_defs.txt
stat -c '%a %U %G' /etc/passwd /etc/shadow > evidence/file_perms.txt

# Access log evidence
last -n 100 > evidence/last_logins.txt
journalctl -u sshd --since "30 days ago" --output json > evidence/ssh_access.json
getent group sudo wheel > evidence/privileged_groups.txt

# Change management evidence
git log --since="3 months ago" --format='%H|%an|%aI|%s' > evidence/git_changes.txt

# Cloud evidence
aws cloudtrail lookup-events --start-time 2026-01-01 --output json > evidence/cloudtrail.json
aws iam get-credential-report --output text --query Content | base64 -d > evidence/iam_report.csv
```

## Integrity Verification

```bash
# Generate SHA-256 manifest
find evidence/ -type f -exec sha256sum {} \; > evidence/manifest.sha256

# Verify manifest integrity
sha256sum -c evidence/manifest.sha256

# Generate individual file hash
sha256sum evidence/sshd_config.txt

# Create HMAC for tamper detection
openssl dgst -sha256 -hmac "audit-key-2026" evidence/manifest.sha256
```

## Evidence Organization

```bash
# Structure evidence by framework
mkdir -p evidence/{pci-dss,soc2,hipaa,iso27001}/{access,config,change,test}

# Archive evidence package
tar -czf evidence-package-$(date +%Y%m%d).tar.gz evidence/
sha256sum evidence-package-*.tar.gz > evidence-package.sha256

# List evidence by control mapping
node scripts/agent.js --action map --evidence-dir evidence/ \
  --frameworks pci-dss --output evidence-map.json
jq '.mapping.mappings[] | {file: .evidence_file, controls: [.controls[].control]}' \
  evidence-map.json
```

## Retention Requirements

| Framework | Minimum Retention | Notes |
|-----------|------------------|-------|
| PCI DSS | 1 year | 3 months immediately available |
| SOC 2 | 1 year | Per audit period |
| HIPAA | 6 years | From date of creation |
| ISO 27001 | 3 years | Per certification cycle |
| SOX | 7 years | Financial records |
