Monitoring and Logging

- CloudTrail / Activity Log / Audit Log coverage - Log forwarding to SIEM - Alerting on critical events (root login, policy changes, IAM) - GuardDuty / Defender for Cloud / Security Command Center For each finding class provide: exact CLI commands (aws-cli, az, gcloud), detection logic, risk scoring, and remediation Terraform/ARM/CloudFormation snippets. Include a prioritized remediation roadmap.