blockmine 1.24.0 → 1.25.0

package/.claude/skills/cloud-engineering/resources/cloud-security-tools.md

@@ -1,1530 +0,0 @@
-# Cloud Security Tools
-
-Cloud Security Posture Management (CSPM), Cloud Workload Protection Platforms (CWPP), container security, and native cloud security services.
-
-## Table of Contents
-
-- [Overview](#overview)
-- [Trend Micro Cloud One](#trend-micro-cloud-one)
-- [Prisma Cloud (Palo Alto)](#prisma-cloud-palo-alto)
-- [Wiz](#wiz)
-- [Aqua Security](#aqua-security)
-- [AWS Security Hub](#aws-security-hub)
-- [Microsoft Defender for Cloud](#microsoft-defender-for-cloud)
-- [Google Cloud Security Command Center](#google-cloud-security-command-center)
-- [Tool Comparison](#tool-comparison)
-- [Integration Patterns](#integration-patterns)
-- [Best Practices](#best-practices)
-
----
-
-## Overview
-
-**Cloud Security Tools** provide comprehensive security across cloud environments, including posture management, threat detection, compliance monitoring, and workload protection.
-
-**Tool Categories:**
-
-```
-Security Tool Landscape:
-┌─────────────────────────────────────────────────────┐
-│ CSPM (Cloud Security Posture Management)            │
-│ - Configuration scanning                            │
-│ - Compliance monitoring (FedRAMP, CMMC, PCI-DSS)    │
-│ - Misconfiguration detection                        │
-│ - Policy enforcement                                │
-├─────────────────────────────────────────────────────┤
-│ CWPP (Cloud Workload Protection Platform)           │
-│ - Runtime protection                                │
-│ - Vulnerability scanning                            │
-│ - Malware detection                                 │
-│ - File integrity monitoring                         │
-├─────────────────────────────────────────────────────┤
-│ Container Security                                  │
-│ - Image scanning                                    │
-│ - Runtime security                                  │
-│ - Kubernetes security                               │
-│ - Registry scanning                                 │
-├─────────────────────────────────────────────────────┤
-│ Code Security (SAST/SCA)                            │
-│ - Static analysis                                   │
-│ - Dependency scanning                               │
-│ - IaC security scanning                             │
-│ - Secret detection                                  │
-└─────────────────────────────────────────────────────┘
-```
-
----
-
-## Trend Micro Cloud One
-
-**Trend Micro Cloud One** is a comprehensive cloud security platform with modular services for workload, container, network, file storage, and conformity (CSPM).
-
-### Components
-
-| Component | Purpose | Use Case |
-|-----------|---------|----------|
-| Workload Security | Server/VM protection | Runtime protection, anti-malware |
-| Container Security | Container image scanning | CI/CD integration, registry scanning |
-| Network Security | Virtual patching | IPS/IDS for cloud workloads |
-| File Storage Security | Object storage scanning | S3/Blob malware scanning |
-| Conformity | CSPM, compliance | FedRAMP, CMMC, CIS benchmarks |
-| Application Security | Runtime RASP | Application-level protection |
-
-### Conformity (CSPM) Setup
-
-**1. AWS Integration:**
-
-```bash
-# Install Conformity CloudFormation template
-aws cloudformation create-stack \
-  --stack-name TrendMicroConformity \
-  --template-url https://conformity-templates.s3.amazonaws.com/cloudformation/conformity-role.template \
-  --parameters \
-    ParameterKey=ExternalId,ParameterValue=YOUR_EXTERNAL_ID \
-  --capabilities CAPABILITY_NAMED_IAM \
-  --region us-east-1
-
-# Get Role ARN for Conformity console
-aws cloudformation describe-stacks \
-  --stack-name TrendMicroConformity \
-  --query 'Stacks[0].Outputs[?OutputKey==`ConformityRoleArn`].OutputValue' \
-  --output text
-```
-
-**2. Terraform Integration:**
-
-```hcl
-# Conformity IAM role
-resource "aws_iam_role" "conformity_role" {
-  name = "TrendMicroConformityRole"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::717210094962:root"
-        }
-        Action = "sts:AssumeRole"
-        Condition = {
-          StringEquals = {
-            "sts:ExternalId" = var.conformity_external_id
-          }
-        }
-      }
-    ]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "conformity_readonly" {
-  role       = aws_iam_role.conformity_role.name
-  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
-}
-
-# Additional permissions for deeper scanning
-resource "aws_iam_role_policy" "conformity_additional" {
-  name = "ConformityAdditionalPermissions"
-  role = aws_iam_role.conformity_role.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Action = [
-          "sns:Publish",
-          "s3:GetBucketPublicAccessBlock",
-          "s3:GetAccountPublicAccessBlock"
-        ]
-        Resource = "*"
-      }
-    ]
-  })
-}
-```
-
-**3. Conformity Rule Configuration:**
-
-```yaml
-# conformity-rules.yaml
-# Custom rule profiles for compliance
----
-rules:
-  - id: S3-001
-    name: "S3 bucket encryption enabled"
-    severity: VERY_HIGH
-    enabled: true
-    compliance:
-      - FedRAMP
-      - CMMC-L2
-      - NIST-800-171
-
-  - id: IAM-045
-    name: "IAM password policy meets requirements"
-    severity: HIGH
-    enabled: true
-    settings:
-      minimumPasswordLength: 14
-      requireUppercase: true
-      requireLowercase: true
-      requireNumbers: true
-      requireSymbols: true
-      maxPasswordAge: 90
-
-  - id: VPC-007
-    name: "VPC flow logs enabled"
-    severity: MEDIUM
-    enabled: true
-    compliance:
-      - FedRAMP
-      - PCI-DSS
-```
-
-**4. Container Security Integration:**
-
-```yaml
-# .gitlab-ci.yml integration
-stages:
-  - build
-  - scan
-  - deploy
-
-container_scan:
-  stage: scan
-  image: trendmicro/smartcheck-scan-action:latest
-  script:
-    - |
-      docker run --rm \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        trendmicro/tmas-scan:latest \
-        --image-name ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA} \
-        --smartcheck-host ${SMARTCHECK_HOST} \
-        --smartcheck-user ${SMARTCHECK_USER} \
-        --smartcheck-password ${SMARTCHECK_PASSWORD} \
-        --severity-threshold medium
-```
-
----
-
-## Prisma Cloud (Palo Alto)
-
-**Prisma Cloud** is a comprehensive Cloud Native Application Protection Platform (CNAPP) providing CSPM, CWPP, and code security.
-
-### Capabilities
-
-```
-Prisma Cloud Platform:
-┌─────────────────────────────────────────────────────┐
-│ Code Security (Bridgecrew)                          │
-│ - IaC scanning (Terraform, CloudFormation, K8s)     │
-│ - Secret detection in repos                         │
-│ - VCS integration (GitHub, GitLab, Bitbucket)       │
-├─────────────────────────────────────────────────────┤
-│ CSPM (Posture Management)                           │
-│ - Multi-cloud visibility (AWS, Azure, GCP, OCI)     │
-│ - Compliance frameworks (40+)                       │
-│ - Asset inventory                                   │
-├─────────────────────────────────────────────────────┤
-│ CWPP (Workload Protection)                          │
-│ - Runtime defense                                   │
-│ - Vulnerability management                          │
-│ - Compliance scanning                               │
-├─────────────────────────────────────────────────────┤
-│ Container Security (Twistlock)                      │
-│ - Image scanning                                    │
-│ - Registry scanning                                 │
-│ - Runtime protection                                │
-│ - Kubernetes security                               │
-└─────────────────────────────────────────────────────┘
-```
-
-### AWS Integration
-
-**1. Onboarding AWS Account:**
-
-```bash
-# Create IAM role for Prisma Cloud
-# Download CloudFormation template from Prisma Cloud console
-aws cloudformation create-stack \
-  --stack-name PrismaCloudRole \
-  --template-url https://prisma-cloud-templates.s3.amazonaws.com/prisma-cloud-aws-iam-role.template \
-  --parameters \
-    ParameterKey=PrismaCloudRoleArn,ParameterValue=arn:aws:iam::188619942792:root \
-    ParameterKey=ExternalId,ParameterValue=YOUR_EXTERNAL_ID \
-  --capabilities CAPABILITY_NAMED_IAM
-```
-
-**2. Terraform for Prisma Cloud Integration:**
-
-```hcl
-# Prisma Cloud provider configuration
-terraform {
-  required_providers {
-    prismacloud = {
-      source  = "PaloAltoNetworks/prismacloud"
-      version = "~> 1.4"
-    }
-  }
-}
-
-provider "prismacloud" {
-  url      = var.prisma_api_url
-  username = var.prisma_access_key
-  password = var.prisma_secret_key
-}
-
-# Add cloud account to Prisma Cloud
-resource "prismacloud_cloud_account" "aws_account" {
-  aws {
-    account_id    = "123456789012"
-    enabled       = true
-    group_ids     = [prismacloud_account_group.production.group_id]
-    name          = "Production AWS Account"
-    role_arn      = "arn:aws:iam::123456789012:role/PrismaCloudRole"
-    account_type  = "account"
-  }
-}
-
-# Create account group
-resource "prismacloud_account_group" "production" {
-  name        = "Production Accounts"
-  description = "All production cloud accounts"
-}
-
-# Create alert rule
-resource "prismacloud_alert_rule" "high_severity" {
-  name        = "High Severity Violations"
-  description = "Alert on high severity policy violations"
-  enabled     = true
-
-  policies = [
-    prismacloud_policy.s3_encryption.policy_id,
-    prismacloud_policy.public_s3.policy_id
-  ]
-
-  target {
-    account_groups = [prismacloud_account_group.production.group_id]
-  }
-
-  notification_config {
-    config_type = "email"
-    recipients  = ["security@company.com"]
-  }
-}
-
-# Custom policy
-resource "prismacloud_policy" "s3_encryption" {
-  name        = "S3 Bucket Encryption Mandatory"
-  policy_type = "config"
-  cloud_type  = "aws"
-  severity    = "high"
-  enabled     = true
-
-  rule {
-    name = "S3 encryption check"
-    rule_type = "Config"
-
-    criteria = "$.resource.aws_s3_bucket[*].server_side_encryption_configuration does not exist"
-
-    parameters = {
-      savedSearch = "false"
-      withIac     = "true"
-    }
-  }
-
-  compliance_metadata {
-    compliance_id    = "fedramp-high"
-    requirement_id   = "SC-28"
-    requirement_name = "Protection of Information at Rest"
-  }
-}
-```
-
-**3. Kubernetes Runtime Protection:**
-
-```yaml
-# Deploy Prisma Cloud Defender as DaemonSet
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: twistlock-defender-ds
-  namespace: twistlock
-spec:
-  selector:
-    matchLabels:
-      app: twistlock-defender
-  template:
-    metadata:
-      labels:
-        app: twistlock-defender
-    spec:
-      serviceAccountName: twistlock-service
-      hostPID: true
-      hostNetwork: true
-      containers:
-      - name: twistlock-defender
-        image: registry.twistlock.com/twistlock/defender:defender_22_12_694
-        env:
-        - name: DEFENDER_TYPE
-          value: "daemonset"
-        - name: DEFENDER_LISTENER_TYPE
-          value: "none"
-        - name: CONSOLE_ADDR
-          value: "https://console.prismacloud.io"
-        - name: DEFENDER_CLUSTER_ID
-          value: "production-cluster"
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - name: docker-sock
-          mountPath: /var/run/docker.sock
-        - name: host-root
-          mountPath: /host
-      volumes:
-      - name: docker-sock
-        hostPath:
-          path: /var/run/docker.sock
-      - name: host-root
-        hostPath:
-          path: /
-```
-
-**4. CI/CD Integration:**
-
-```yaml
-# GitHub Actions integration
-name: Prisma Cloud IaC Scan
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  prisma_cloud_iac_scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Run Prisma Cloud IaC Scan
-        uses: bridgecrewio/checkov-action@master
-        with:
-          api-key: ${{ secrets.PRISMA_ACCESS_KEY }}::${{ secrets.PRISMA_SECRET_KEY }}
-          directory: terraform/
-          framework: terraform
-          soft_fail: false
-          output_format: cli,sarif
-          output_file_path: console,results.sarif
-
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: results.sarif
-```
-
----
-
-## Wiz
-
-**Wiz** is a cloud security platform providing comprehensive visibility, risk prioritization, and threat detection across multi-cloud environments.
-
-### Core Capabilities
-
-```
-Wiz Security Platform:
-┌─────────────────────────────────────────────────────┐
-│ Security Graph                                      │
-│ - Full cloud environment mapping                    │
-│ - Relationship visualization                        │
-│ - Attack path analysis                              │
-├─────────────────────────────────────────────────────┤
-│ Risk Prioritization                                 │
-│ - Critical path detection                           │
-│ - Toxic combinations                                │
-│ - Exploitability scoring                            │
-├─────────────────────────────────────────────────────┤
-│ Vulnerability Management                            │
-│ - VM/container scanning                             │
-│ - Serverless scanning                               │
-│ - Prioritized remediation                           │
-├─────────────────────────────────────────────────────┤
-│ Data Security                                       │
-│ - Sensitive data discovery                          │
-│ - Data classification                               │
-│ - Exposure analysis                                 │
-└─────────────────────────────────────────────────────┘
-```
-
-### AWS Integration
-
-**1. Connector Setup:**
-
-```bash
-# Deploy Wiz CloudFormation stack
-# This creates a read-only role for Wiz scanner
-aws cloudformation create-stack \
-  --stack-name WizConnector \
-  --template-url https://wiz-security-templates.s3.amazonaws.com/connector.yaml \
-  --parameters \
-    ParameterKey=WizExternalId,ParameterValue=YOUR_EXTERNAL_ID \
-    ParameterKey=EnableCloudTrail,ParameterValue=true \
-    ParameterKey=EnableVulnerabilityScanning,ParameterValue=true \
-  --capabilities CAPABILITY_NAMED_IAM
-```
-
-**2. Terraform Wiz Connector:**
-
-```hcl
-# Wiz connector IAM role
-resource "aws_iam_role" "wiz_connector" {
-  name = "WizSecurityConnector"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::197171649850:root"
-        }
-        Action = "sts:AssumeRole"
-        Condition = {
-          StringEquals = {
-            "sts:ExternalId" = var.wiz_external_id
-          }
-        }
-      }
-    ]
-  })
-}
-
-# Wiz requires SecurityAudit + additional permissions
-resource "aws_iam_role_policy_attachment" "wiz_security_audit" {
-  role       = aws_iam_role.wiz_connector.name
-  policy_arn = "arn:aws:iam::aws:policy/SecurityAudit"
-}
-
-resource "aws_iam_role_policy" "wiz_additional" {
-  name = "WizAdditionalPermissions"
-  role = aws_iam_role.wiz_connector.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "WizVulnerabilityScanning"
-        Effect = "Allow"
-        Action = [
-          "ec2:DescribeImages",
-          "ec2:DescribeSnapshots",
-          "ec2:CreateSnapshots",
-          "ec2:DeleteSnapshot",
-          "ecr:GetAuthorizationToken",
-          "ecr:BatchCheckLayerAvailability",
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:BatchGetImage"
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "WizDataScanning"
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:ListBucket"
-        ]
-        Resource = [
-          "arn:aws:s3:::*/*",
-          "arn:aws:s3:::*"
-        ]
-      }
-    ]
-  })
-}
-```
-
-**3. Wiz CLI Integration:**
-
-```bash
-# Install Wiz CLI
-curl -o wizcli https://wizcli.app.wiz.io/wizcli
-chmod +x wizcli
-
-# Authenticate
-export WIZ_CLIENT_ID="your-client-id"
-export WIZ_CLIENT_SECRET="your-client-secret"
-
-# Scan Docker image
-./wizcli docker scan \
-  --image myapp:latest \
-  --policy "Production Policy" \
-  --output-format json
-
-# Scan IaC directory
-./wizcli iac scan \
-  --path ./terraform \
-  --policy-id abcd1234 \
-  --fail-on high
-```
-
-**4. API Integration for Automation:**
-
-```python
-# wiz_integration.py
-import requests
-import json
-
-class WizAPI:
-    def __init__(self, client_id, client_secret):
-        self.api_url = "https://api.us1.app.wiz.io/graphql"
-        self.token = self._authenticate(client_id, client_secret)
-
-    def _authenticate(self, client_id, client_secret):
-        auth_url = "https://auth.app.wiz.io/oauth/token"
-        payload = {
-            "grant_type": "client_credentials",
-            "client_id": client_id,
-            "client_secret": client_secret,
-            "audience": "wiz-api"
-        }
-        response = requests.post(auth_url, json=payload)
-        return response.json()["access_token"]
-
-    def query_issues(self, severity="CRITICAL"):
-        query = """
-        query IssuesTable($filterBy: IssueFilters) {
-          issues(filterBy: $filterBy, first: 100) {
-            nodes {
-              id
-              type
-              severity
-              status
-              entitySnapshot {
-                name
-                type
-              }
-            }
-          }
-        }
-        """
-        variables = {
-            "filterBy": {
-                "severity": [severity],
-                "status": ["OPEN"]
-            }
-        }
-
-        headers = {"Authorization": f"Bearer {self.token}"}
-        response = requests.post(
-            self.api_url,
-            json={"query": query, "variables": variables},
-            headers=headers
-        )
-        return response.json()
-
-# Usage
-wiz = WizAPI(
-    client_id="your-client-id",
-    client_secret="your-client-secret"
-)
-critical_issues = wiz.query_issues(severity="CRITICAL")
-print(json.dumps(critical_issues, indent=2))
-```
-
----
-
-## Aqua Security
-
-**Aqua Security** provides comprehensive container and cloud-native security from development to runtime.
-
-### Platform Components
-
-| Component | Purpose |
-|-----------|---------|
-| Aqua Console | Central management, policy engine |
-| Aqua Scanner | Image and registry scanning |
-| Aqua Enforcer | Runtime protection for containers |
-| Aqua Gateway | Communication hub |
-| MicroEnforcer | Lightweight runtime protection |
-| KubeEnforcer | Kubernetes admission controller |
-
-### Kubernetes Deployment
-
-**1. Deploy Aqua Platform:**
-
-```yaml
-# aqua-namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: aqua
-
----
-# aqua-db.yaml (PostgreSQL for Aqua)
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: aqua-db
-  namespace: aqua
-spec:
-  serviceName: aqua-db
-  replicas: 1
-  selector:
-    matchLabels:
-      app: aqua-db
-  template:
-    metadata:
-      labels:
-        app: aqua-db
-    spec:
-      containers:
-      - name: postgres
-        image: postgres:13
-        env:
-        - name: POSTGRES_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: aqua-db
-              key: password
-        volumeMounts:
-        - name: postgres-data
-          mountPath: /var/lib/postgresql/data
-  volumeClaimTemplates:
-  - metadata:
-      name: postgres-data
-    spec:
-      accessModes: ["ReadWriteOnce"]
-      resources:
-        requests:
-          storage: 50Gi
-
----
-# aqua-console.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: aqua-console
-  namespace: aqua
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: aqua-console
-  template:
-    metadata:
-      labels:
-        app: aqua-console
-    spec:
-      containers:
-      - name: aqua-console
-        image: registry.aquasec.com/console:2022.4
-        env:
-        - name: SCALOCK_DBUSER
-          value: "postgres"
-        - name: SCALOCK_DBPASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: aqua-db
-              key: password
-        - name: SCALOCK_DBNAME
-          value: "scalock"
-        - name: SCALOCK_DBHOST
-          value: "aqua-db"
-        - name: SCALOCK_AUDIT_DBUSER
-          value: "postgres"
-        - name: SCALOCK_AUDIT_DBPASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: aqua-db
-              key: password
-        - name: SCALOCK_AUDIT_DBNAME
-          value: "slk_audit"
-        - name: SCALOCK_AUDIT_DBHOST
-          value: "aqua-db"
-        ports:
-        - containerPort: 8080
-        - containerPort: 8443
-```
-
-**2. Aqua Enforcer DaemonSet:**
-
-```yaml
-# aqua-enforcer.yaml
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: aqua-enforcer
-  namespace: aqua
-spec:
-  selector:
-    matchLabels:
-      app: aqua-enforcer
-  template:
-    metadata:
-      labels:
-        app: aqua-enforcer
-    spec:
-      serviceAccountName: aqua-sa
-      hostPID: true
-      containers:
-      - name: enforcer
-        image: registry.aquasec.com/enforcer:2022.4
-        env:
-        - name: AQUA_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: aqua-enforcer-token
-              key: token
-        - name: AQUA_SERVER
-          value: "aqua-gateway:8443"
-        - name: AQUA_LOGICAL_NAME
-          value: "production-cluster"
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - name: docker-sock
-          mountPath: /var/run/docker.sock
-        - name: containerd-sock
-          mountPath: /run/containerd/containerd.sock
-      volumes:
-      - name: docker-sock
-        hostPath:
-          path: /var/run/docker.sock
-      - name: containerd-sock
-        hostPath:
-          path: /run/containerd/containerd.sock
-```
-
-**3. KubeEnforcer (Admission Controller):**
-
-```yaml
-# aqua-kube-enforcer.yaml
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  name: kube-enforcer-admission-hook
-webhooks:
-- name: imageassurance.aquasec.com
-  clientConfig:
-    service:
-      namespace: aqua
-      name: aqua-kube-enforcer
-      path: /v1/imagechecks
-    caBundle: LS0tLS1CRUdJTi... # Base64 encoded CA cert
-  rules:
-  - operations: ["CREATE", "UPDATE"]
-    apiGroups: ["*"]
-    apiVersions: ["*"]
-    resources: ["pods"]
-  failurePolicy: Fail
-  sideEffects: None
-  admissionReviewVersions: ["v1", "v1beta1"]
-
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: aqua-kube-enforcer
-  namespace: aqua
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: aqua-kube-enforcer
-  template:
-    metadata:
-      labels:
-        app: aqua-kube-enforcer
-    spec:
-      serviceAccountName: aqua-kube-enforcer-sa
-      containers:
-      - name: kube-enforcer
-        image: registry.aquasec.com/kube-enforcer:2022.4
-        env:
-        - name: AQUA_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: aqua-kube-enforcer-token
-              key: token
-        - name: AQUA_GATEWAY_URL
-          value: "aqua-gateway:8443"
-        ports:
-        - containerPort: 8443
-```
-
-**4. CI/CD Scanner Integration:**
-
-```yaml
-# .gitlab-ci.yml
-stages:
-  - build
-  - scan
-  - deploy
-
-aqua_scan:
-  stage: scan
-  image: registry.aquasec.com/scanner:2022.4
-  script:
-    - |
-      docker run --rm \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        registry.aquasec.com/scanner:2022.4 \
-        scan \
-        --host $AQUA_SERVER \
-        --user $AQUA_USERNAME \
-        --password $AQUA_PASSWORD \
-        --register \
-        --local ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHA}
-  only:
-    - branches
-```
-
----
-
-## AWS Security Hub
-
-**AWS Security Hub** provides a comprehensive view of security alerts and compliance status across AWS accounts.
-
-### Setup and Configuration
-
-**1. Enable Security Hub:**
-
-```bash
-# Enable Security Hub in all regions
-for region in us-east-1 us-west-2 eu-west-1; do
-  aws securityhub enable-security-hub \
-    --region $region \
-    --enable-default-standards
-done
-
-# Enable specific standards
-aws securityhub batch-enable-standards \
-  --standards-subscription-requests \
-    '[{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}]' \
-  --region us-east-1
-```
-
-**2. Terraform Configuration:**
-
-```hcl
-# Enable Security Hub
-resource "aws_securityhub_account" "main" {}
-
-# Enable CIS AWS Foundations Benchmark
-resource "aws_securityhub_standards_subscription" "cis" {
-  depends_on    = [aws_securityhub_account.main]
-  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
-}
-
-# Enable AWS Foundational Security Best Practices
-resource "aws_securityhub_standards_subscription" "aws_foundational" {
-  depends_on    = [aws_securityhub_account.main]
-  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
-}
-
-# Enable PCI DSS
-resource "aws_securityhub_standards_subscription" "pci_dss" {
-  depends_on    = [aws_securityhub_account.main]
-  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/pci-dss/v/3.2.1"
-}
-
-# Custom insights
-resource "aws_securityhub_insight" "critical_findings" {
-  filters {
-    severity_label {
-      comparison = "EQUALS"
-      value      = "CRITICAL"
-    }
-    workflow_status {
-      comparison = "EQUALS"
-      value      = "NEW"
-    }
-  }
-
-  group_by_attribute = "ResourceType"
-  name               = "Critical Unresolved Findings by Resource Type"
-}
-
-# EventBridge rule for critical findings
-resource "aws_cloudwatch_event_rule" "security_hub_findings" {
-  name        = "security-hub-critical-findings"
-  description = "Capture critical Security Hub findings"
-
-  event_pattern = jsonencode({
-    source      = ["aws.securityhub"]
-    detail-type = ["Security Hub Findings - Imported"]
-    detail = {
-      findings = {
-        Severity = {
-          Label = ["CRITICAL", "HIGH"]
-        }
-        Workflow = {
-          Status = ["NEW"]
-        }
-      }
-    }
-  })
-}
-
-resource "aws_cloudwatch_event_target" "sns" {
-  rule      = aws_cloudwatch_event_rule.security_hub_findings.name
-  target_id = "SendToSNS"
-  arn       = aws_sns_topic.security_alerts.arn
-}
-```
-
-**3. Custom Actions:**
-
-```python
-# security_hub_automation.py
-import boto3
-import json
-
-securityhub = boto3.client('securityhub')
-
-def remediate_public_s3_bucket(finding):
-    """Auto-remediate public S3 buckets"""
-    s3 = boto3.client('s3')
-    bucket_name = finding['Resources'][0]['Id'].split(':')[-1]
-
-    # Block public access
-    s3.put_public_access_block(
-        Bucket=bucket_name,
-        PublicAccessBlockConfiguration={
-            'BlockPublicAcls': True,
-            'IgnorePublicAcls': True,
-            'BlockPublicPolicy': True,
-            'RestrictPublicBuckets': True
-        }
-    )
-
-    # Update finding status
-    securityhub.batch_update_findings(
-        FindingIdentifiers=[{
-            'Id': finding['Id'],
-            'ProductArn': finding['ProductArn']
-        }],
-        Workflow={'Status': 'RESOLVED'},
-        Note={
-            'Text': 'Auto-remediated: Blocked public access',
-            'UpdatedBy': 'AutoRemediation'
-        }
-    )
-
-# Lambda handler
-def lambda_handler(event, context):
-    finding = event['detail']['findings'][0]
-
-    if 'S3.1' in finding['Title']:  # S3 bucket public read
-        remediate_public_s3_bucket(finding)
-
-    return {'statusCode': 200}
-```
-
----
-
-## Microsoft Defender for Cloud
-
-**Microsoft Defender for Cloud** (formerly Azure Security Center + Azure Defender) provides unified security management and threat protection.
-
-### Components
-
-| Component | Purpose |
-|-----------|---------|
-| Defender for Servers | VM protection, JIT access |
-| Defender for Containers | AKS, ACR security |
-| Defender for Storage | Blob/File protection |
-| Defender for SQL | Database security |
-| Defender for Key Vault | Secret protection |
-| Defender CSPM | Posture management |
-
-### Setup
-
-**1. Enable Defender for Cloud:**
-
-```bash
-# Enable Defender for Cloud (Standard tier)
-az security pricing create \
-  --name VirtualMachines \
-  --tier Standard
-
-az security pricing create \
-  --name Containers \
-  --tier Standard
-
-az security pricing create \
-  --name StorageAccounts \
-  --tier Standard
-
-# Enable auto-provisioning
-az security auto-provisioning-setting update \
-  --auto-provision On \
-  --name default
-```
-
-**2. Terraform Configuration:**
-
-```hcl
-# Enable Defender for Cloud plans
-resource "azurerm_security_center_subscription_pricing" "vm" {
-  tier          = "Standard"
-  resource_type = "VirtualMachines"
-}
-
-resource "azurerm_security_center_subscription_pricing" "containers" {
-  tier          = "Standard"
-  resource_type = "Containers"
-}
-
-resource "azurerm_security_center_subscription_pricing" "storage" {
-  tier          = "Standard"
-  resource_type = "StorageAccounts"
-}
-
-# Enable auto-provisioning of Log Analytics agent
-resource "azurerm_security_center_auto_provisioning" "auto_provisioning" {
-  auto_provision = "On"
-}
-
-# Configure Log Analytics workspace
-resource "azurerm_security_center_workspace" "workspace" {
-  scope        = "/subscriptions/${data.azurerm_subscription.current.subscription_id}"
-  workspace_id = azurerm_log_analytics_workspace.security.id
-}
-
-# Security contacts
-resource "azurerm_security_center_contact" "contact" {
-  email               = "security@company.com"
-  phone               = "+1-555-0100"
-  alert_notifications = true
-  alerts_to_admins    = true
-}
-
-# Regulatory compliance assessments
-resource "azurerm_security_center_assessment" "fedramp_high" {
-  assessment_policy_id = "/providers/Microsoft.Authorization/policyDefinitions/fedramp-high"
-  target_resource_id   = data.azurerm_subscription.current.id
-}
-
-# Just-In-Time VM Access
-resource "azurerm_security_center_jit_network_access_policy" "jit_policy" {
-  name                = "jit-policy-vm"
-  kind                = "Basic"
-  location            = azurerm_resource_group.rg.location
-  resource_group_name = azurerm_resource_group.rg.name
-
-  virtual_machine {
-    virtual_machine_id = azurerm_linux_virtual_machine.vm.id
-
-    port {
-      number                     = 22
-      protocol                   = "TCP"
-      allowed_source_address_prefix = ["10.0.0.0/8"]
-      max_request_access_duration = "PT3H"
-    }
-
-    port {
-      number                     = 3389
-      protocol                   = "TCP"
-      allowed_source_address_prefix = ["10.0.0.0/8"]
-      max_request_access_duration = "PT3H"
-    }
-  }
-}
-```
-
-**3. Azure Policy Integration:**
-
-```bash
-# Assign built-in initiatives for compliance
-az policy assignment create \
-  --name 'fedramp-high' \
-  --display-name 'FedRAMP High Compliance' \
-  --policy-set-definition '/providers/Microsoft.Authorization/policySetDefinitions/fedramp-high' \
-  --scope "/subscriptions/${SUBSCRIPTION_ID}"
-
-# Custom policy for tagging enforcement
-az policy definition create \
-  --name 'require-classification-tag' \
-  --display-name 'Require Classification Tag' \
-  --mode Indexed \
-  --rules '{
-    "if": {
-      "field": "tags[Classification]",
-      "exists": "false"
-    },
-    "then": {
-      "effect": "deny"
-    }
-  }'
-```
-
----
-
-## Google Cloud Security Command Center
-
-**Google Cloud Security Command Center (SCC)** provides centralized visibility and control over GCP security.
-
-### Tiers
-
-| Tier | Features |
-|------|----------|
-| Standard (Free) | Asset discovery, vulnerability scanning, basic findings |
-| Premium | Advanced threat detection, compliance monitoring, Event Threat Detection, Container Threat Detection |
-
-### Setup
-
-**1. Enable SCC:**
-
-```bash
-# Enable SCC API
-gcloud services enable securitycenter.googleapis.com
-
-# Enable SCC Premium
-gcloud scc settings update \
-  --organization=123456789 \
-  --tier=PREMIUM
-
-# Enable built-in services
-gcloud scc settings services enable \
-  --organization=123456789 \
-  --service=CONTAINER_THREAT_DETECTION
-
-gcloud scc settings services enable \
-  --organization=123456789 \
-  --service=EVENT_THREAT_DETECTION
-
-gcloud scc settings services enable \
-  --organization=123456789 \
-  --service=SECURITY_HEALTH_ANALYTICS
-```
-
-**2. Terraform Configuration:**
-
-```hcl
-# Enable SCC
-resource "google_scc_organization_settings" "scc_settings" {
-  organization = "123456789"
-
-  asset_discovery_config {
-    project_ids = ["project-1", "project-2"]
-    inclusion_mode = "INCLUDE_ONLY"
-  }
-}
-
-# Create notification config
-resource "google_scc_notification_config" "scc_notification" {
-  config_id    = "critical-findings"
-  organization = "123456789"
-  description  = "Notify on critical findings"
-  pubsub_topic = google_pubsub_topic.scc_notifications.id
-
-  streaming_config {
-    filter = "severity=\"CRITICAL\" AND state=\"ACTIVE\""
-  }
-}
-
-resource "google_pubsub_topic" "scc_notifications" {
-  name = "scc-critical-findings"
-}
-
-# Custom security marks
-resource "google_scc_source" "custom_source" {
-  display_name = "Custom Security Scanner"
-  organization = "123456789"
-  description  = "Custom vulnerability scanner"
-}
-```
-
-**3. Findings API Integration:**
-
-```python
-# scc_findings.py
-from google.cloud import securitycenter
-
-def list_all_findings(organization_id):
-    """List all active findings"""
-    client = securitycenter.SecurityCenterClient()
-    org_name = f"organizations/{organization_id}/sources/-"
-
-    # List findings
-    findings = client.list_findings(
-        request={
-            "parent": org_name,
-            "filter": 'state="ACTIVE" AND severity="CRITICAL"'
-        }
-    )
-
-    for finding in findings:
-        print(f"Finding: {finding.finding.name}")
-        print(f"  Category: {finding.finding.category}")
-        print(f"  Resource: {finding.finding.resource_name}")
-        print(f"  Severity: {finding.finding.severity}")
-        print(f"  State: {finding.finding.state}")
-
-def create_finding(organization_id, source_id, finding_id):
-    """Create a custom finding"""
-    client = securitycenter.SecurityCenterClient()
-    source_name = f"organizations/{organization_id}/sources/{source_id}"
-
-    finding = {
-        "state": securitycenter.Finding.State.ACTIVE,
-        "resource_name": f"//cloudresourcemanager.googleapis.com/organizations/{organization_id}",
-        "category": "CUSTOM_VULNERABILITY",
-        "severity": securitycenter.Finding.Severity.HIGH,
-        "event_time": {"seconds": int(time.time())},
-        "finding_class": securitycenter.Finding.FindingClass.VULNERABILITY,
-    }
-
-    created_finding = client.create_finding(
-        request={
-            "parent": source_name,
-            "finding_id": finding_id,
-            "finding": finding
-        }
-    )
-
-    return created_finding
-
-# Usage
-list_all_findings("123456789")
-```
-
----
-
-## Tool Comparison
-
-### Feature Matrix
-
-| Feature | Trend Micro | Prisma Cloud | Wiz | Aqua | AWS Hub | Azure Defender | GCP SCC |
-|---------|-------------|--------------|-----|------|---------|----------------|---------|
-| **Multi-Cloud** | ✅ | ✅ | ✅ | ✅ | AWS only | Azure only | GCP only |
-| **CSPM** | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
-| **Container Security** | ✅ | ✅ | ✅ | ✅ | Limited | ✅ | ✅ |
-| **Runtime Protection** | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | Limited |
-| **IaC Scanning** | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | ❌ |
-| **Kubernetes** | ✅ | ✅ | ✅ | ✅ | Limited | ✅ | ✅ |
-| **Compliance** | 40+ | 40+ | 35+ | 30+ | 3 | 25+ | 15+ |
-| **Agentless** | ❌ | ✅ | ✅ | ❌ | ✅ | ✅ | ✅ |
-| **On-Prem** | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ |
-
-### Cost Comparison (Approximate)
-
-| Tool | Pricing Model | Est. Cost (100 workloads) |
-|------|--------------|---------------------------|
-| Trend Micro Cloud One | Per workload | $5-10/workload/month |
-| Prisma Cloud | Per credit/resource | $15K-30K/year |
-| Wiz | Per workload | $8-15/workload/month |
-| Aqua Security | Per node | $10-20/node/month |
-| AWS Security Hub | Per check | $0.0010/check (~$100-500/month) |
-| Microsoft Defender | Per resource | $15/server/month, $7/storage/month |
-| GCP SCC Premium | Flat + usage | $2,500/month + usage |
-
----
-
-## Integration Patterns
-
-### 1. Multi-Tool Strategy
-
-```
-Layered Security Approach:
-┌─────────────────────────────────────────────────────┐
-│ Development Phase                                   │
-│ - Prisma Cloud (IaC scanning)                       │
-│ - Aqua (Container scanning in CI/CD)                │
-└───────────────┬─────────────────────────────────────┘
-                ↓
-┌───────────────┴─────────────────────────────────────┐
-│ Deployment Phase                                    │
-│ - Wiz (Pre-deployment validation)                   │
-│ - Native cloud tools (Security Hub/Defender/SCC)    │
-└───────────────┬─────────────────────────────────────┘
-                ↓
-┌───────────────┴─────────────────────────────────────┐
-│ Runtime Phase                                       │
-│ - Trend Micro (Workload protection)                 │
-│ - Aqua (Container runtime security)                 │
-│ - Wiz (Continuous threat detection)                 │
-└─────────────────────────────────────────────────────┘
-```
-
-### 2. Centralized Findings Aggregation
-
-```python
-# aggregate_findings.py
-"""Aggregate findings from multiple security tools"""
-import boto3
-import requests
-from google.cloud import securitycenter
-
-class SecurityAggregator:
-    def __init__(self):
-        self.findings = []
-
-    def get_aws_findings(self):
-        """Get findings from AWS Security Hub"""
-        securityhub = boto3.client('securityhub')
-        response = securityhub.get_findings(
-            Filters={
-                'SeverityLabel': [{'Value': 'CRITICAL', 'Comparison': 'EQUALS'}],
-                'WorkflowStatus': [{'Value': 'NEW', 'Comparison': 'EQUALS'}]
-            }
-        )
-        return response['Findings']
-
-    def get_prisma_findings(self, api_url, token):
-        """Get findings from Prisma Cloud"""
-        headers = {'Authorization': f'Bearer {token}'}
-        response = requests.get(
-            f"{api_url}/api/v1/alerts",
-            headers=headers,
-            params={'severity': 'high', 'status': 'open'}
-        )
-        return response.json()
-
-    def get_wiz_findings(self, client_id, secret):
-        """Get findings from Wiz"""
-        # Implementation similar to earlier Wiz API example
-        pass
-
-    def normalize_findings(self, findings, source):
-        """Normalize findings to common format"""
-        normalized = []
-        for finding in findings:
-            normalized.append({
-                'source': source,
-                'severity': self._normalize_severity(finding, source),
-                'resource': self._extract_resource(finding, source),
-                'description': self._extract_description(finding, source),
-                'compliance': self._extract_compliance(finding, source)
-            })
-        return normalized
-
-    def aggregate_all(self):
-        """Aggregate from all sources"""
-        self.findings.extend(
-            self.normalize_findings(self.get_aws_findings(), 'AWS Security Hub')
-        )
-        # Add other sources...
-        return self.findings
-
-# Usage
-aggregator = SecurityAggregator()
-all_findings = aggregator.aggregate_all()
-```
-
----
-
-## Best Practices
-
-### 1. Tool Selection
-
-**Decision Matrix:**
-
-| Requirement | Recommended Tool(s) |
-|-------------|---------------------|
-| AWS-only environment | AWS Security Hub + Prisma Cloud |
-| Azure-only | Microsoft Defender for Cloud |
-| GCP-only | GCP SCC Premium + Wiz |
-| Multi-cloud | Prisma Cloud or Wiz |
-| Container-heavy | Aqua Security or Prisma Cloud |
-| Air-gapped | Trend Micro (on-prem) or Aqua |
-| Budget-conscious | Native tools (Security Hub, Defender, SCC) |
-| Comprehensive | Prisma Cloud or Wiz |
-
-### 2. Alert Fatigue Reduction
-
-```yaml
-# Prioritization strategy
-alert_tiers:
-  tier_1_critical:
-    - Public exposure of sensitive data
-    - Active exploitation detected
-    - Privilege escalation
-    - Crypto mining
-    action: Immediate notification + auto-remediation
-
-  tier_2_high:
-    - Critical vulnerabilities
-    - Compliance violations
-    - Misconfigured security groups
-    action: Next-business-day review
-
-  tier_3_medium:
-    - Best practice violations
-    - Outdated software
-    action: Weekly review
-
-  tier_4_low:
-    - Informational findings
-    action: Monthly review + reports
-```
-
-### 3. Compliance Mapping
-
-```bash
-# Tag resources for compliance tracking
-# All CSPM tools can filter by tags
-
-# Terraform example
-resource "aws_instance" "web" {
-  ami           = "ami-12345"
-  instance_type = "t3.medium"
-
-  tags = {
-    Classification = "CUI"
-    Compliance     = "FedRAMP-High,CMMC-L2,NIST-800-171"
-    DataOwner      = "security@agency.gov"
-    Environment    = "Production"
-    CostCenter     = "12345"
-  }
-}
-```
-
-### 4. Continuous Monitoring
-
-```python
-# monitoring_automation.py
-"""Continuous compliance monitoring"""
-import schedule
-import time
-
-def daily_compliance_check():
-    """Run daily compliance scans"""
-    # Check all tools
-    check_prisma_compliance()
-    check_wiz_compliance()
-    check_native_tools()
-
-    # Generate report
-    generate_compliance_report()
-
-def weekly_vulnerability_scan():
-    """Weekly vulnerability assessment"""
-    scan_with_aqua()
-    scan_with_trend_micro()
-    correlate_findings()
-
-def monthly_compliance_report():
-    """Monthly executive report"""
-    aggregate_findings()
-    calculate_risk_score()
-    send_executive_summary()
-
-# Schedule jobs
-schedule.every().day.at("02:00").do(daily_compliance_check)
-schedule.every().monday.at("03:00").do(weekly_vulnerability_scan)
-schedule.every().month.at("05:00").do(monthly_compliance_report)
-
-while True:
-    schedule.run_pending()
-    time.sleep(3600)  # Check every hour
-```
-
----
-
-**Related Resources:**
-- [cloud-security.md](cloud-security.md) - IAM, encryption, compliance
-- [cleared-cloud-environments.md](cleared-cloud-environments.md) - Government cloud security
-- [devsecops/cspm-integration.md](../devsecops/resources/cspm-integration.md) - CI/CD integration
-- [devsecops/compliance-frameworks.md](../devsecops/resources/compliance-frameworks.md) - Compliance requirements