Compliance Evidence Collector

Log Collection and Verification

• Collect security event logs
• Verify log retention compliance
• Document log integrity mechanisms
• Export SIEM correlation rules
• Capture alerting configurations
• Archive incident response logs

Policy Document Management

• Version control policy documents
• Track policy review and approval dates
• Document policy acknowledgments
• Archive superseded policies
• Generate policy compliance matrices

Screenshot Automation

• Automate evidence screenshots for manual controls
• Capture UI-based configuration evidence
• Document workflow approvals
• Screenshot training completion records

Evidence Chain of Custody

• Maintain evidence metadata and timestamps
• Track evidence collection dates
• Document evidence sources
• Generate evidence inventories
• Create audit-ready packages

Evidence Categories

Technical Evidence

• System configurations
• Security tool outputs
• Vulnerability scan results
• Penetration test reports
• Code analysis results

Administrative Evidence

• Policies and procedures
• Training records
• Risk assessments
• Incident reports
• Change management records

Physical Evidence

• Facility access logs
• Visitor records
• Asset inventories
• Environmental controls documentation

Framework Mapping

Integrations

• AWS: Config, CloudTrail, IAM, Security Hub
• Azure: Policy, Activity Log, Azure AD, Defender
• GCP: Cloud Asset Inventory, Audit Logs, IAM
• Identity Providers: Okta, Azure AD, Google Workspace
• SIEM Systems: Splunk, Elastic, Sentinel, Chronicle
• Security Tools: Various vulnerability scanners, EDR

Target Processes

• All compliance audit processes
• Continuous compliance monitoring
• Audit preparation
• Control validation

Input Schema

{
  "type": "object",
  "properties": {
    "frameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["SOC2", "GDPR", "HIPAA", "PCI-DSS", "ISO27001", "NIST", "FedRAMP"]
      },
      "description": "Target compliance frameworks"
    },
    "evidenceTypes": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["cloud-config", "access-control", "logs", "policies", "screenshots", "network", "encryption"]
      }
    },
    "cloudProviders": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["AWS", "Azure", "GCP"]
      }
    },
    "dateRange": {
      "type": "object",
      "properties": {
        "startDate": { "type": "string", "format": "date" },
        "endDate": { "type": "string", "format": "date" }
      }
    },
    "controlIds": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific control IDs to collect evidence for"
    },
    "outputPath": {
      "type": "string",
      "description": "Base path for evidence storage"
    }
  },
  "required": ["frameworks", "evidenceTypes"]
}

Output Schema

{
  "type": "object",
  "properties": {
    "collectionId": {
      "type": "string"
    },
    "collectionDate": {
      "type": "string",
      "format": "date-time"
    },
    "frameworks": {
      "type": "array"
    },
    "evidenceSummary": {
      "type": "object",
      "properties": {
        "totalItems": { "type": "integer" },
        "collected": { "type": "integer" },
        "failed": { "type": "integer" },
        "pending": { "type": "integer" }
      }
    },
    "evidenceInventory": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "evidenceId": { "type": "string" },
          "controlId": { "type": "string" },
          "type": { "type": "string" },
          "source": { "type": "string" },
          "collectionTimestamp": { "type": "string" },
          "filePath": { "type": "string" },
          "hash": { "type": "string" },
          "status": { "type": "string" }
        }
      }
    },
    "chainOfCustody": {
      "type": "object",
      "properties": {
        "collector": { "type": "string" },
        "collectionMethod": { "type": "string" },
        "integrityVerification": { "type": "string" }
      }
    },
    "gaps": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "controlId": { "type": "string" },
          "missingEvidence": { "type": "string" },
          "reason": { "type": "string" }
        }
      }
    },
    "auditPackage": {
      "type": "object",
      "properties": {
        "basePath": { "type": "string" },
        "indexFile": { "type": "string" },
        "totalSize": { "type": "string" }
      }
    }
  }
}

Usage Example