EXTENSIONS

Unified daily operator briefing report. A workflow-scope report over the

Query and manage AWS Security Hub findings from a delegated administrator

Unified drift detection surface that composes observations from existing

Observe AWS Config compliance evaluations as typed queryable data.

Observe a Claude Enterprise account via the Compliance API. Covers the

Cloudflare security and configuration audit workflow.

Terraform drift detection for AWS — compares Terraform state against live

AWS cost audit workflow — identifies infrastructure waste by combining

Standalone swamp port of ArcKit (https://github.com/tractorjuice/arc-kit —

Microsoft Purview compliance-portal RBAC — role groups, their constituent management roles, membership, and the eDiscovery Administrator list, over Security & Compliance PowerShell. Exists because eDiscovery permission is invisible from Entra: Global Administrator maps to OrganizationManagement, which carries Case Management, Compliance Search, Hold and Search And Purge but not Export, Preview, Review, RMS Decrypt or Custodian, so a tenant admin can run a search yet be unable to export a single item. auditPrincipals separates canSearch from canExport and flags eDiscovery Administrators, who can open every case in the tenant. Carries its own credential surface because the compliance endpoint rejects Azure CLI tokens regardless of user.

Pages through the Coder audit log API and writes events as versioned data. Supports incremental collection with configurable limits and query filters.