# AWS: Configure an organization trail with data events
aws cloudtrail create-trail \
  --name org-comprehensive-trail \
  --s3-bucket-name org-audit-central \
  --is-organization-trail \
  --is-multi-region-trail \
  --enable-log-file-validation \
  --include-global-service-events \
  --kms-key-id arn:aws:kms:eu-west-1:111111111111:key/KEY_ID

# Add data events
aws cloudtrail put-event-selectors \
  --trail-name org-comprehensive-trail \
  --advanced-event-selectors '[
    {
      "Name": "Log all S3 data events",
      "FieldSelectors": [
        {"Field": "eventCategory", "Equals": ["Data"]},
        {"Field": "resources.type", "Equals": ["AWS::S3::Object"]}
      ]
    },
    {
      "Name": "Log all Lambda invocations",
      "FieldSelectors": [
        {"Field": "eventCategory", "Equals": ["Data"]},
        {"Field": "resources.type", "Equals": ["AWS::Lambda::Function"]}
      ]
    },
    {
      "Name": "Log all management events",
      "FieldSelectors": [
        {"Field": "eventCategory", "Equals": ["Management"]}
      ]
    }
  ]'

# Enable insights
aws cloudtrail put-insight-selectors \
  --trail-name org-comprehensive-trail \
  --insight-selectors '[
    {"InsightType": "ApiCallRateInsight"},
    {"InsightType": "ApiErrorRateInsight"}
  ]'

# AWS: Send CloudTrail to CloudWatch Logs for real-time alerting
aws cloudtrail update-trail \
  --name org-comprehensive-trail \
  --cloud-watch-logs-log-group-arn arn:aws:logs:eu-west-1:111111111111:log-group:CloudTrail:* \
  --cloud-watch-logs-role-arn arn:aws:iam::111111111111:role/CloudTrail-CWL-Role

# Create metric filters for suspicious activities
# IAM user creation
aws logs put-metric-filter \
  --log-group-name CloudTrail \
  --filter-name IAMUserCreation \
  --filter-pattern '{ $.eventName = "CreateUser" }' \
  --metric-transformations \
    metricName=IAMUserCreation,metricNamespace=Security,metricValue=1

# Access key creation
aws logs put-metric-filter \
  --log-group-name CloudTrail \
  --filter-name AccessKeyCreation \
  --filter-pattern '{ $.eventName = "CreateAccessKey" }' \
  --metric-transformations \
    metricName=AccessKeyCreation,metricNamespace=Security,metricValue=1

# Trust policy modification
aws logs put-metric-filter \
  --log-group-name CloudTrail \
  --filter-name TrustPolicyChange \
  --filter-pattern '{ $.eventName = "UpdateAssumeRolePolicy" }' \
  --metric-transformations \
    metricName=TrustPolicyChange,metricNamespace=Security,metricValue=1

# Create alarms
aws cloudwatch put-metric-alarm \
  --alarm-name "IAM-User-Created" \
  --metric-name IAMUserCreation \
  --namespace Security \
  --statistic Sum \
  --period 300 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:eu-west-1:111111111111:security-alerts

# Azure: KQL query for anomalous sign-in detection
# In Log Analytics / Azure Sentinel:

# Unusual sign-in locations for service principals
# SigninLogs
# | where AppDisplayName != ""
# | where ResultType == 0
# | summarize
#     locations = make_set(Location),
#     count = count()
#   by AppDisplayName, AppId
# | where array_length(locations) > 3

# AWS: Athena query for unusual AssumeRole patterns
# Create an Athena table on the CloudTrail S3 bucket
# and query for:
# - AssumeRole from unknown source accounts
# - AssumeRole with unusually long durations
# - AssumeRole with suspicious session names

# GCP: BigQuery export of audit logs
# bq query '
#   SELECT
#     protopayload_auditlog.authenticationInfo.principalEmail,
#     protopayload_auditlog.methodName,
#     protopayload_auditlog.requestMetadata.callerIp,
#     COUNT(*) as call_count
#   FROM `project.dataset.cloudaudit_googleapis_com_activity_*`
#   WHERE _TABLE_SUFFIX >= FORMAT_DATE("%Y%m%d", DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))
#   GROUP BY 1, 2, 3
#   HAVING call_count > 100
#   ORDER BY call_count DESC
# '