メニュー
Implement Cloud Security Posture Management using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud vulnerability detection.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/Undermybelt/hermes-skills --skill cloud-vuln-posture-mgmtコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.
Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.
Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.
SOC 職業分類に基づく
SKILL.md を表示中
| name | cloud-vuln-posture-mgmt |
| description | Implement Cloud Security Posture Management using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite for multi-cloud vulnerability detection. |
| domain | cybersecurity |
| subdomain | vulnerability-management |
| tags | ["cspm","cloud-security","aws-security-hub","azure-defender","prowler","scoutsuite","misconfiguration","cnapp"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-02","ID.IM-02","ID.RA-06"] |
Cloud Security Posture Management (CSPM) continuously monitors cloud infrastructure for misconfigurations, compliance violations, and security risks. Unlike traditional vulnerability scanning, CSPM focuses on cloud-native risks: IAM over-permissions, exposed storage buckets, unencrypted data, missing network controls, and service misconfigurations. This skill covers multi-cloud CSPM using AWS Security Hub, Azure Defender for Cloud, and open-source tools like Prowler and ScoutSuite.
boto3, azure-identity, azure-mgmt-security# Enable AWS Security Hub with default standards
aws securityhub enable-security-hub \
--enable-default-standards \
--region us-east-1
# Enable specific standards
aws securityhub batch-enable-standards \
--standards-subscription-requests \
'{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}' \
'{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"}'
# Get findings summary
aws securityhub get-findings \
--filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}],"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' \
--max-items 10
| Standard | Description |
|---|---|
| AWS Foundational Security Best Practices | AWS-recommended baseline controls |
| CIS AWS Foundations Benchmark 1.4 |
| CIS hardening requirements |
| PCI DSS v3.2.1 | Payment card industry controls |
| NIST SP 800-53 Rev 5 | Federal security controls |
# Enable Defender for Cloud free tier
az security pricing create \
--name CloudPosture \
--tier standard
# Check secure score
az security secure-score list \
--query "[].{Name:displayName,Score:current,Max:max}" \
--output table
# Get security recommendations
az security assessment list \
--query "[?status.code=='Unhealthy'].{Name:displayName,Severity:metadata.severity,Resource:resourceDetails.id}" \
--output table
# Get alerts
az security alert list \
--query "[?status=='Active'].{Name:alertDisplayName,Severity:severity,Time:timeGeneratedUtc}" \
--output table
# Install Prowler
pip install prowler
# Run full AWS scan
prowler aws --output-formats json-ocsf,csv,html
# Run specific checks
prowler aws --checks s3_bucket_public_access iam_root_mfa_enabled ec2_sg_open_to_internet
# Run against specific AWS profile and region
prowler aws --profile production --region us-east-1 --output-formats json-ocsf
# Run CIS Benchmark compliance check
prowler aws --compliance cis_1.5_aws
# Run PCI DSS compliance
prowler aws --compliance pci_3.2.1_aws
# Scan Azure environment
prowler azure --subscription-ids "sub-id-here"
# Scan GCP environment
prowler gcp --project-ids "project-id-here"
| Category | Examples |
|---|---|
| IAM | Root MFA, password policy, access key rotation |
| S3 | Public access, encryption, versioning |
| EC2 | Security groups, EBS encryption, metadata service |
| RDS | Public access, encryption, backup retention |
| CloudTrail | Enabled, encrypted, log validation |
| VPC | Flow logs, default SG restrictions |
| Lambda | Public access, runtime versions |
| EKS | Public endpoint, secrets encryption |
# Install ScoutSuite
pip install scoutsuite
# Run AWS assessment
scout aws --profile production
# Run Azure assessment
scout azure --cli
# Run GCP assessment
scout gcp --project-id my-project
# Results available as interactive HTML report
# Open scout-report/report.html in browser
import json
import subprocess
from datetime import datetime, timezone
def run_prowler_scan(provider, output_dir, compliance=None):
"""Run Prowler scan for a cloud provider."""
cmd = ["prowler", provider, "--output-formats", "json-ocsf",
"--output-directory", output_dir]
if compliance:
cmd.extend(["--compliance", compliance])
result = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
return result.returncode == 0
def aggregate_findings(prowler_dirs):
"""Aggregate findings from multiple Prowler scans."""
all_findings = []
for scan_dir in prowler_dirs:
json_files = list(Path(scan_dir).glob("*.json"))
for jf in json_files:
with open(jf, "r") as f:
for line in f:
try:
finding = json.loads(line.strip())
all_findings.append(finding)
except json.JSONDecodeError:
continue
# Sort by severity
severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "informational": 4}
all_findings.sort(key=lambda f: severity_order.get(
f.get("severity", "informational").lower(), 5
))
return all_findings
def generate_posture_report(findings, output_path):
"""Generate cloud security posture report."""
report = {
"generated_at": datetime.now(timezone.utc).isoformat(),
"total_findings": len(findings),
"by_severity": {},
"by_provider": {},
"by_service": {},
}
for f in findings:
sev = f.get("severity", "unknown")
provider = f.get("cloud_provider", "unknown")
service = f.get("service_name", "unknown")
report["by_severity"][sev] = report["by_severity"].get(sev, 0) + 1
report["by_provider"][provider] = report["by_provider"].get(provider, 0) + 1
report["by_service"][service] = report["by_service"].get(service, 0) + 1
with open(output_path, "w") as f:
json.dump(report, f, indent=2)
return report