Compliance Evidence Collector Skill

Purpose

Automate compliance evidence collection across multiple frameworks by gathering configuration snapshots, access control evidence, logs, policies, and documentation from cloud providers, identity systems, and security tools.

Capabilities

Cloud Configuration Evidence

• Capture AWS, Azure, GCP configuration snapshots
• Document IAM policies and role configurations
• Export security group and network ACL settings
• Collect encryption settings and key management evidence
• Screenshot cloud console configurations
• Archive CloudTrail, Activity Logs, Audit Logs

Access Control Evidence

• Export user and group listings
• Document role-based access control configurations
• Capture privileged access reviews
• Collect authentication policy evidence
• Document MFA enrollment status
• Archive access provisioning/deprovisioning records

Log Collection and Verification

• Collect security event logs
• Verify log retention compliance
• Document log integrity mechanisms
• Export SIEM correlation rules
• Capture alerting configurations
• Archive incident response logs

Policy Document Management

• Version control policy documents
• Track policy review and approval dates
• Document policy acknowledgments
• Archive superseded policies
• Generate policy compliance matrices

Screenshot Automation

• Automate evidence screenshots for manual controls
• Capture UI-based configuration evidence
• Document workflow approvals
• Screenshot training completion records

Evidence Chain of Custody

• Maintain evidence metadata and timestamps
• Track evidence collection dates
• Document evidence sources
• Generate evidence inventories
• Create audit-ready packages

Evidence Categories

Technical Evidence

• System configurations
• Security tool outputs
• Vulnerability scan results
• Penetration test reports
• Code analysis results

Administrative Evidence

• Policies and procedures
• Training records
• Risk assessments
• Incident reports
• Change management records

Physical Evidence

• Facility access logs
• Visitor records
• Asset inventories
• Environmental controls documentation

Framework Mapping

Framework	Evidence Types
SOC 2	Technical, Administrative, Screenshots
GDPR	Data processing, Consent, Privacy
HIPAA	ePHI, Safeguards, BAAs
PCI DSS	CDE, Network, ASV scans
ISO 27001	ISMS, Controls, Risk
NIST	Security controls, Risk management
FedRAMP	Cloud security, Continuous monitoring

Integrations

• AWS: Config, CloudTrail, IAM, Security Hub
• Azure: Policy, Activity Log, Azure AD, Defender
• GCP: Cloud Asset Inventory, Audit Logs, IAM
• Identity Providers: Okta, Azure AD, Google Workspace
• SIEM Systems: Splunk, Elastic, Sentinel, Chronicle
• Security Tools: Various vulnerability scanners, EDR

Target Processes

• All compliance audit processes
• Continuous compliance monitoring
• Audit preparation
• Control validation

Input Schema

{
  "type": "object",
  "properties": {
    "frameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["SOC2", "GDPR", "HIPAA", "PCI-DSS", "ISO27001", "NIST", "FedRAMP"]
      },
      "description": "Target compliance frameworks"
    },
    "evidenceTypes": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["cloud-config", "access-control", "logs", "policies", "screenshots", "network", "encryption"]
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "dateRange": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "controlIds": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific control IDs to collect evidence for"
    },
    "outputPath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["frameworks", "evidenceTypes"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "collectionId": {
      "type": "string"
    },
    "collectionDate": {
      "type": "string",
      "format": "date-time"
    },
    "frameworks": {
      "type": "array"
    },
    "evidenceSummary": {
      "type": "object",
      "properties": {
        "totalItems": { "type": "integer" },
        "collected": { "type": "integer" },
        "failed": { "type": "integer" },
        "pending": { "type": "integer" }
      }
    },
    "evidenceInventory": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "evidenceId": { "type": "string" },
          "controlId": { "type": "string" },
          "type": { "type": "string" },
          "source": { "type": "string" },
          "collectionTimestamp": { "type": "string" },
          "filePath": { "type": "string" },
          "hash": { "type": "string" },
          "status": { "type": "string" }
        }
      }
    },
    "chainOfCustody": {
      "type": "object",
      "properties": {
        "collector": { "type": "string" },
        "collectionMethod": { "type": "string" },
        "integrityVerification": { "type": "string" }
      }
    },
    "gaps": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "missingEvidence": { "type": "string" },
          "reason": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "basePath": { "type": "string" },
        "indexFile": { "type": "string" },
        "totalSize": { "type": "string" }
      }
    }
  }
}

Usage Example

skill: {
  name: 'compliance-evidence-collector',
  context: {
    frameworks: ['SOC2', 'ISO27001'],
    evidenceTypes: ['cloud-config', 'access-control', 'logs'],
    cloudProviders: ['AWS', 'Azure'],
    dateRange: {
      startDate: '2024-01-01',
      endDate: '2024-12-31'
    }
  }
}