Multi-Cloud Security Posture Skill

Purpose

Unified cloud security posture management (CSPM) across AWS, Azure, and GCP to aggregate findings, normalize security metrics, compare against CIS benchmarks, and provide a consolidated view of multi-cloud security.

Capabilities

Cross-Cloud Finding Aggregation

• Collect findings from AWS, Azure, and GCP
• Aggregate results from cloud-native security tools
• Import findings from third-party CSPM tools
• Deduplicate findings across environments
• Correlate related issues across clouds

Metric Normalization

• Standardize severity ratings across clouds
• Normalize finding categories
• Create unified compliance metrics
• Calculate aggregate risk scores
• Generate comparable security ratings

CIS Benchmark Comparison

• Apply CIS benchmarks across all clouds
• Compare security posture against benchmarks
• Track benchmark compliance over time
• Identify benchmark drift
• Generate benchmark compliance reports

Remediation Status Tracking

• Track remediation across all clouds
• Monitor fix verification status
• Calculate mean time to remediate (MTTR)
• Generate remediation progress reports
• Prioritize cross-cloud remediation efforts

Unified Reporting

• Generate executive dashboards
• Create technical detail reports
• Produce compliance comparison matrices
• Build trend analysis reports
• Export data for external tools

Drift Detection and Alerting

• Monitor configuration drift
• Alert on security posture degradation
• Detect new non-compliant resources
• Track policy violations
• Send real-time notifications

Normalized Categories

Category	AWS	Azure	GCP
Identity	IAM	Azure AD	Cloud IAM
Compute	EC2, Lambda	VMs, Functions	Compute, Functions
Storage	S3, EBS	Storage Accounts	Cloud Storage
Network	VPC, SGs	VNet, NSGs	VPC, Firewall
Database	RDS, DynamoDB	SQL, Cosmos	Cloud SQL, Spanner
Encryption	KMS	Key Vault	Cloud KMS
Logging	CloudTrail	Activity Log	Audit Logs

Compliance Frameworks

• CIS Benchmarks (AWS, Azure, GCP)
• SOC 2 Type II
• PCI DSS v4.0
• HIPAA Security Rule
• ISO 27001
• NIST 800-53
• FedRAMP

Integrations

• Cloud Provider APIs: AWS, Azure, GCP native tools
• Wiz: Cloud security platform
• Orca Security: Agentless cloud security
• Prisma Cloud: Multi-cloud CSPM
• Lacework: Cloud security and compliance
• Cloud Custodian: Cloud governance as code

Target Processes

• Cloud Security Architecture Review
• Continuous Compliance Monitoring
• Multi-Cloud Governance
• Security Posture Reporting

Input Schema

{
  "type": "object",
  "properties": {
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      },
      "description": "Cloud providers to include"
    },
    "awsAccounts": {
      "type": "array",
      "items": { "type": "string" }
    },
    "azureSubscriptions": {
      "type": "array",
      "items": { "type": "string" }
    },
    "gcpProjects": {
      "type": "array",
      "items": { "type": "string" }
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "SOC2", "PCI-DSS", "HIPAA", "ISO27001", "NIST", "FedRAMP"]
      }
    },
    "reportingPeriod": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low"]
    },
    "includeRemediationStatus": {
      "type": "boolean"
    }
  },
  "required": ["cloudProviders"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "reportId": {
      "type": "string"
    },
    "reportTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "cloudsCovered": {
      "type": "array"
    },
    "overallPosture": {
      "type": "object",
      "properties": {
        "aggregateScore": { "type": "number" },
        "riskLevel": { "type": "string" },
        "trend": { "type": "string", "enum": ["improving", "stable", "degrading"] }
      }
    },
    "postureByCloud": {
      "type": "object",
      "properties": {
        "AWS": {
          "type": "object",
          "properties": {
            "score": { "type": "number" },
            "findings": { "type": "integer" },
            "criticalFindings": { "type": "integer" }
          }
        },
        "Azure": { "type": "object" },
        "GCP": { "type": "object" }
      }
    },
    "findingsByCategory": {
      "type": "object",
      "properties": {
        "identity": { "type": "integer" },
        "compute": { "type": "integer" },
        "storage": { "type": "integer" },
        "network": { "type": "integer" },
        "encryption": { "type": "integer" },
        "logging": { "type": "integer" }
      }
    },
    "complianceStatus": {
      "type": "object"
    },
    "topFindings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "cloud": { "type": "string" },
          "category": { "type": "string" },
          "severity": { "type": "string" },
          "count": { "type": "integer" },
          "description": { "type": "string" }
        }
      }
    },
    "remediationProgress": {
      "type": "object",
      "properties": {
        "totalFindings": { "type": "integer" },
        "remediated": { "type": "integer" },
        "inProgress": { "type": "integer" },
        "pending": { "type": "integer" },
        "mttr": { "type": "string" }
      }
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

skill: {
  name: 'multi-cloud-security-posture',
  context: {
    cloudProviders: ['AWS', 'Azure', 'GCP'],
    awsAccounts: ['123456789012'],
    azureSubscriptions: ['sub-id-1'],
    gcpProjects: ['my-project'],
    complianceFrameworks: ['CIS', 'SOC2'],
    includeRemediationStatus: true
  }
}