{
  "$schema": "https://arthaops.com/schemas/detector-registry/v1.json",
  "schema_version": "1.0.0",
  "specification_id": "SPEC-ENG-2026-REG-01",
  "generated_at": "2026-10-13T03:28:26Z",
  "integrity_hash_sha256": "eeacdfc7be6f6866f83ca0ff63e24861e1d4dae4379470974926456228ce5db6",
  "summary": {
    "total_internal_registry_count": 378,
    "public_eligible_count": 373,
    "quarantined_count": 5,
    "lifecycle_matrix": {
      "aws": {
        "production_ga": 228
      },
      "azure": {
        "developer_preview": 62
      },
      "gcp": {
        "developer_preview": 61
      },
      "kubernetes": {
        "developer_preview": 21
      },
      "multicloud": {
        "developer_preview": 1
      }
    }
  },
  "guarantees_and_disclaimers": {
    "agentless_invariant": "100% of detectors execute via cloud-native APIs with zero required agents, sidecars, or in-guest daemons.",
    "two_plane_security_model": "Discovery Plane 1 operates strictly under read-only permissions (SecurityAudit). Remediation in Plane 2 requires explicit human operator authorization.",
    "developer_preview_boundary": "Detectors marked developer_preview (Azure, GCP, Kubernetes) provide read-only telemetry and IaC recommendations; they do not perform automated live mutation.",
    "savings_qualification": "Monetary estimates represent gross potential waste; realized savings depend on active enterprise discount programs (EDPs), Savings Plans, and Reserved Instances."
  },
  "detectors": [
    {
      "id": "agt-01",
      "name": "Bedrock invocations 10\u00d7 above 14-day baseline \u2014 probable agent loop",
      "cloud": "aws",
      "service": "agents",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "agt-02",
      "name": "AI-tagged Lambda with no reserved concurrency limit (uncapped agent execution)",
      "cloud": "aws",
      "service": "agents",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "agt-03",
      "name": "SageMaker endpoint: 1-day invocations > 5\u00d7 14-day average (rogue caller)",
      "cloud": "aws",
      "service": "agents",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "agt-04",
      "name": "IAM role with bedrock:InvokeModel on Resource:* (no model restriction)",
      "cloud": "aws",
      "service": "agents",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "agt-05",
      "name": "3+ active Bedrock models with AI Lambdas missing budget tags (ungoverned multi-model agent)",
      "cloud": "aws",
      "service": "agents",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-cluster-oversized-distributed-nodes",
      "name": "Distributed Training Cluster Worker Nodes Experiencing Sustained Idle Time > 40%",
      "cloud": "aws",
      "service": "ai_cluster_governance",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-embedding-dimension-bloat",
      "name": "High-Dimension Embedding Model (>=3072 dim) Used for Low-Cardinality Search",
      "cloud": "aws",
      "service": "ai_cluster_governance",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-inference-batching-underutilized",
      "name": "Model Serving Endpoint Lacking Dynamic Batching Under High Concurrent QPS",
      "cloud": "aws",
      "service": "ai_cluster_governance",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-storage-checkpoint-sprawl",
      "name": "Stale Intermediate Model Checkpoints Retained on High-Performance Storage",
      "cloud": "aws",
      "service": "ai_cluster_governance",
      "category": "ebs",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-01",
      "name": "QuickSight Unused Author/Admin Licenses",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-02",
      "name": "Idle AppStream Fleet Instances",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-03",
      "name": "Idle AWS Transfer Family Servers",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-04",
      "name": "CodeBuild Projects Using Expensive Build Environments",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-05",
      "name": "WAFv2 Web ACLs with No Associated Resources",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-06",
      "name": "DataSync Tasks Never Executed",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-07",
      "name": "AWS Shield Advanced Subscription Active",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "analytics-08",
      "name": "WorkSpaces Using High-Tier Bundles",
      "cloud": "aws",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "athena-01",
      "name": "Athena Workgroups without Query Result Reuse",
      "cloud": "aws",
      "service": "athena",
      "category": "athena",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "athena-02",
      "name": "Athena Workgroups without Data Scan Limit",
      "cloud": "aws",
      "service": "athena",
      "category": "athena",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "athena-03",
      "name": "Athena Queries Scanning Excessive Data",
      "cloud": "aws",
      "service": "athena",
      "category": "athena",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "athena-04",
      "name": "Athena Named Queries Sprawl",
      "cloud": "aws",
      "service": "athena",
      "category": "athena",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "athena-05",
      "name": "Athena Tables without Partition Pruning",
      "cloud": "aws",
      "service": "athena",
      "category": "athena",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "bud-01",
      "name": "Bedrock model invocation spike: 1-day rate > 5\u00d7 14-day average",
      "cloud": "aws",
      "service": "budget",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "bud-02",
      "name": "SageMaker endpoint exceeding \u20b925,000/mo (budget governance threshold)",
      "cloud": "aws",
      "service": "budget",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "bud-03",
      "name": "AI-tagged Lambda with > 20% error rate over 7 days (inference failure storm)",
      "cloud": "aws",
      "service": "budget",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "bud-04",
      "name": "EC2 GPU on-demand > 7 days \u2014 Spot viable for 70% savings",
      "cloud": "aws",
      "service": "budget",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "bud-05",
      "name": "Active Bedrock models with no CostCenter cost allocation tag on account",
      "cloud": "aws",
      "service": "budget",
      "category": "ml",
      "surface": "ai",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-01",
      "name": "ElastiCache with < 1% cache hit rate",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-02",
      "name": "Kinesis Data Streams with 0 bytes for 14 days",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-03",
      "name": "Redis ElastiCache clusters not in replication group (no HA)",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-04",
      "name": "ElastiCache with > 80% FreeableMemory (oversized)",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-05",
      "name": "Amazon MQ brokers with 0 messages in 14 days",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-06",
      "name": "ElastiCache with high evictions (cache too small)",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-07",
      "name": "Kinesis Data Firehose delivery streams with 0 records in 14 days",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-08",
      "name": "Redis replication groups with high replication lag (replica waste)",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-09",
      "name": "Kinesis Analytics applications with 0 records in 14 days",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "cache-10",
      "name": "Memcached clusters with 1 node in production (no HA)",
      "cloud": "aws",
      "service": "cache",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-01",
      "name": "ECS services with < 1% CPU for 14 days",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-02",
      "name": "ECR repositories with images not pulled in 90 days",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-03",
      "name": "ECR images never vulnerability-scanned",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-04",
      "name": "ECS clusters with 0 running tasks and 0 services",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-05",
      "name": "EKS nodegroups with < 20% CPU (over-provisioned)",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-06",
      "name": "Fargate tasks with < 10% CPU utilization",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-07",
      "name": "ECR repositories without lifecycle policy (unlimited image retention)",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-08",
      "name": "EKS clusters running unsupported Kubernetes version",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-09",
      "name": "App Runner services with 0 requests in 14 days",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ctr-10",
      "name": "Lightsail instances with 0 network I/O in 14 days",
      "cloud": "aws",
      "service": "containers",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-01",
      "name": "Unattached EBS volumes (available state)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "direct",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-02",
      "name": "gp2 volumes \u2192 migrate to gp3 (20% cheaper)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-03",
      "name": "EBS snapshots older than 180 days",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-04",
      "name": "Snapshots whose source volume was deleted",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-05",
      "name": "io1/io2 volumes with > 50% over-provisioned IOPS",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-06",
      "name": "EBS volumes with no snapshots in 30 days (backup risk)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-07",
      "name": "Public unencrypted EBS snapshots (security + cost risk)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-08",
      "name": "Volumes with > 30 manual snapshots (no DLM policy)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-09",
      "name": "In-use EBS volumes > 1TB with no IOPS metrics",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ebs-10",
      "name": "st1/sc1 volumes detached for > 14 days (archive to S3)",
      "cloud": "aws",
      "service": "ebs",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-08",
      "name": "Reserved Instances expiring within 30 days",
      "cloud": "aws",
      "service": "ec2_commitments",
      "category": "ec2",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-09",
      "name": "EC2 on-demand spend not covered by Savings Plans",
      "cloud": "aws",
      "service": "ec2_commitments",
      "category": "ec2",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-10",
      "name": "Running EC2 with zero network I/O (completely unused)",
      "cloud": "aws",
      "service": "ec2_commitments",
      "category": "ec2",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-11",
      "name": "Over-provisioned instances not in Auto Scaling Group",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-12",
      "name": "Stopped Windows EC2 (license billing continues)",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-13",
      "name": "Dedicated Hosts with < 50% instance slot utilization",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-14",
      "name": "Empty EC2 Placement Groups",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-15",
      "name": "Unused EC2 Key Pairs (Security Risk)",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-16",
      "name": "Spot Fleets configured with single instance type (high interruption risk)",
      "cloud": "aws",
      "service": "ec2_governance",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-01",
      "name": "Idle EC2 instances (CPU < 5% for 7d)",
      "cloud": "aws",
      "service": "ec2_idle",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-02",
      "name": "Over-provisioned EC2 (CPU < 20%)",
      "cloud": "aws",
      "service": "ec2_idle",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-03",
      "name": "Stopped EC2 instances > 7 days (EBS billing)",
      "cloud": "aws",
      "service": "ec2_idle",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-04",
      "name": "Previous generation EC2 instances (m4, c4, r4)",
      "cloud": "aws",
      "service": "ec2_idle",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-05",
      "name": "Unassociated Elastic IPs ($3.65/mo each)",
      "cloud": "aws",
      "service": "ec2_network_storage",
      "category": "ec2",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-06",
      "name": "Unused AMIs older than 90 days",
      "cloud": "aws",
      "service": "ec2_network_storage",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ec2-07",
      "name": "Available Network Interfaces (Orphaned ENIs)",
      "cloud": "aws",
      "service": "ec2_network_storage",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-01",
      "name": "EMR Clusters Running > 24 Hours",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-02",
      "name": "EMR Clusters Using No Spot Instances",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-03",
      "name": "EMR Clusters without Auto-Termination Policy",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-04",
      "name": "EMR Clusters using Previous Gen Instances",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-05",
      "name": "EMR Clusters without Managed Scaling",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "emr-06",
      "name": "Short-Duration EMR Clusters (EMR Serverless Candidate)",
      "cloud": "aws",
      "service": "emr",
      "category": "emr",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-01",
      "name": "Glue Jobs Never Executed (30 Days)",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-02",
      "name": "Glue Jobs with Excessive DPU Allocation",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-03",
      "name": "Glue Crawlers Never Executed",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-04",
      "name": "Idle Glue Development Endpoints",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-05",
      "name": "Glue Workflows with Failed Runs (>7 days)",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "glue-06",
      "name": "Active Glue Interactive Sessions (Costly)",
      "cloud": "aws",
      "service": "glue",
      "category": "glue",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "gpu-01",
      "name": "EC2 GPU instance with < 5% CPU utilization for 7 days",
      "cloud": "aws",
      "service": "gpu",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "gpu-02",
      "name": "EC2 GPU instance running on-demand > 30 days (RI purchase opportunity)",
      "cloud": "aws",
      "service": "gpu",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "gpu-03",
      "name": "EC2 GPU instance without AutoShutdown or StopAfter tag",
      "cloud": "aws",
      "service": "gpu",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "gpu-04",
      "name": "SageMaker training job on GPU instance without Managed Spot Training",
      "cloud": "aws",
      "service": "gpu",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "gpu-05",
      "name": "SageMaker GPU endpoint with no Application Auto Scaling policy",
      "cloud": "aws",
      "service": "gpu",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-gpu-cpu-bottleneck-waste",
      "name": "GPU Compute Starvation Due to Host CPU/IO Bottleneck",
      "cloud": "aws",
      "service": "gpu_workload_optimizer",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-gpu-cuda-idle-slack",
      "name": "High-Cost GPU Instance Operating with CUDA Engine Utilization < 10%",
      "cloud": "aws",
      "service": "gpu_workload_optimizer",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-gpu-memory-underallocated",
      "name": "Underutilized GPU VRAM Eligible for Multi-Instance GPU (MIG) Slicing",
      "cloud": "aws",
      "service": "gpu_workload_optimizer",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-gpu-spot-training-candidate",
      "name": "Fault-Tolerant GPU Training Workload Operating on On-Demand Instances",
      "cloud": "aws",
      "service": "gpu_workload_optimizer",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ai-gpu-weekend-dormant-cluster",
      "name": "GPU Training Cluster Left Running Over Weekend with Zero Computations",
      "cloud": "aws",
      "service": "gpu_workload_optimizer",
      "category": "ec2",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-01",
      "name": "IAM roles unused for 90+ days",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-02",
      "name": "Enabled KMS CMKs with no usage in 30 days ($1/mo each)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-03",
      "name": "IAM access keys unused for 90+ days",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-04",
      "name": "IAM users with console access but no MFA",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-05",
      "name": "EC2 key pairs older than 365 days (credential hygiene)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-06",
      "name": "IAM roles/users with broad inline policies (cost if breached)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-07",
      "name": "CloudTrail not enabled in region (compliance + cost blindness)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-08",
      "name": "AWS Security Hub HIGH findings not remediated (spend risk)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-09",
      "name": "S3 buckets with public read access (data egress cost risk)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "iam-10",
      "name": "AWS Config recording all resource types (high cost)",
      "cloud": "aws",
      "service": "iam_cost",
      "category": "iam",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "kinesis-01",
      "name": "Idle Kinesis Data Streams",
      "cloud": "aws",
      "service": "kinesis",
      "category": "kinesis",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "kinesis-02",
      "name": "Kinesis Streams with Over-provisioned Shards",
      "cloud": "aws",
      "service": "kinesis",
      "category": "kinesis",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "kinesis-03",
      "name": "Unused Enhanced Fan-Out (EFO) Consumers",
      "cloud": "aws",
      "service": "kinesis",
      "category": "kinesis",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "kinesis-04",
      "name": "Idle Kinesis Firehose Delivery Streams",
      "cloud": "aws",
      "service": "kinesis",
      "category": "kinesis",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "kinesis-05",
      "name": "Kinesis Streams Eligible for On-Demand Mode",
      "cloud": "aws",
      "service": "kinesis",
      "category": "kinesis",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-01",
      "name": "Lambda functions with > 40% over-allocated memory",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-02",
      "name": "Lambda functions with 0 invocations in 30 days",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-03",
      "name": "Lambda functions using deprecated runtimes",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-04",
      "name": "Lambda provisioned concurrency with < 50% utilization",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-05",
      "name": "API Gateway REST APIs with < 10 requests/day",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-06",
      "name": "Lambda functions consistently hitting max timeout",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-07",
      "name": "Step Functions state machines with 0 executions in 30 days",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-08",
      "name": "EventBridge rules with no targets",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-09",
      "name": "SQS queues with 0 messages in 14 days",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-10",
      "name": "SNS topics with no subscribers",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-11",
      "name": "REST APIs candidate for HTTP API migration",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "lambda-12",
      "name": "Lambda functions candidate for arm64 (Graviton2) migration",
      "cloud": "aws",
      "service": "lambda_funcs",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-01",
      "name": "AWS Glue jobs never executed in 30 days",
      "cloud": "aws",
      "service": "legacy_glue_athena",
      "category": "glue",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-02",
      "name": "AWS Glue crawlers not run in 30 days",
      "cloud": "aws",
      "service": "legacy_glue_athena",
      "category": "glue",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-03",
      "name": "AWS Glue development endpoints running (very expensive)",
      "cloud": "aws",
      "service": "legacy_glue_athena",
      "category": "glue",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-04",
      "name": "Athena workgroups without query result reuse enabled",
      "cloud": "aws",
      "service": "legacy_glue_athena",
      "category": "athena",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-05",
      "name": "Athena queries scanning > 1TB/day without partitioning",
      "cloud": "aws",
      "service": "legacy_glue_athena",
      "category": "athena",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-06",
      "name": "Redshift clusters with 0 queries in 14 days",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "redshift",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-07",
      "name": "Redshift clusters without encryption",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "redshift",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-08",
      "name": "Redshift manual snapshots older than 30 days",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "redshift",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-09",
      "name": "OpenSearch domains with 0 search requests in 14 days",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-10",
      "name": "Production OpenSearch domain with single node (no HA)",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-11",
      "name": "OpenSearch domain with < 10% JVMMemoryPressure (oversized)",
      "cloud": "aws",
      "service": "legacy_redshift_opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-12",
      "name": "MSK (Kafka) clusters with 0 bytes in/out in 14 days",
      "cloud": "aws",
      "service": "legacy_streaming_nosql",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-13",
      "name": "EMR clusters running > 7 days continuously",
      "cloud": "aws",
      "service": "legacy_streaming_nosql",
      "category": "glue",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-14",
      "name": "DynamoDB tables with provisioned capacity not using Auto Scaling",
      "cloud": "aws",
      "service": "legacy_streaming_nosql",
      "category": "cache",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "dat-15",
      "name": "DynamoDB tables with 0 read/write operations in 14 days",
      "cloud": "aws",
      "service": "legacy_streaming_nosql",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "llm-idle-fine-tuned-endpoint",
      "name": "Dedicated Fine-Tuned Model Deployment Incurring Idle Hourly Fees",
      "cloud": "aws",
      "service": "llm_token_efficiency",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "llm-model-tier-mismatch",
      "name": "Flagship Model Overkill for Low-Complexity Extraction/Classification Tasks",
      "cloud": "aws",
      "service": "llm_token_efficiency",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "llm-prompt-cache-miss-rate",
      "name": "High Repetitive Prompt Volume Without Prompt Caching Enabled",
      "cloud": "aws",
      "service": "llm_token_efficiency",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "llm-runaway-context-window",
      "name": "Unbounded Chat History Context Bloat Without Periodic Summarization",
      "cloud": "aws",
      "service": "llm_token_efficiency",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "aws-bedrock-ptu-underutilized",
      "name": "AWS Bedrock Provisioned Throughput Operating with Sustained Low Utilization",
      "cloud": "aws",
      "service": "managed_ai_platforms",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "aws-sagemaker-idle-endpoint",
      "name": "SageMaker Real-Time Endpoint Incurring Dedicated Hourly Host Fees with Zero Traffic",
      "cloud": "aws",
      "service": "managed_ai_platforms",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-01",
      "name": "Cognito User Pools with 0 Monthly Active Users",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-02",
      "name": "Cognito App Clients with No Recent Auth",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-03",
      "name": "Pinpoint Projects with No Message Activity",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-04",
      "name": "AppSync APIs with 0 Requests (30 Days)",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-05",
      "name": "IoT Thing Groups with No Attached Things",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-06",
      "name": "Inactive IoT Topic Rules",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-07",
      "name": "Amplify Apps with No Deploys (30 Days)",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-08",
      "name": "API Gateway REST APIs with 0 Calls (30 Days)",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-09",
      "name": "API Gateway HTTP/WebSocket APIs with 0 Calls",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-10",
      "name": "Idle Lightsail Instances",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-11",
      "name": "SNS Topics with 0 Published Messages (30 Days)",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "misc-12",
      "name": "SQS Queues with 0 Messages Sent (30 Days)",
      "cloud": "aws",
      "service": "misc",
      "category": "misc",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-01",
      "name": "SageMaker endpoints with 0 invocations in 14 days",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-02",
      "name": "SageMaker notebooks running > 7 days without modification",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-03",
      "name": "SageMaker training jobs using GPU instances with < 30% GPU utilization",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-04",
      "name": "SageMaker Feature Store groups with no reads in 30 days",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-05",
      "name": "SageMaker Studio domains with no user activity in 30 days",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-06",
      "name": "Bedrock model invocations using expensive models when cheaper alternatives exist",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-07",
      "name": "Amazon Comprehend custom model endpoints with 0 requests in 14 days",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-08",
      "name": "Rekognition Custom Labels projects with running models (no requests)",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-09",
      "name": "Transcribe jobs processing large audio without cost optimizations",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "ml-10",
      "name": "Amazon Personalize campaigns with 0 requests in 14 days",
      "cloud": "aws",
      "service": "ml",
      "category": "ml",
      "surface": "ai",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-01",
      "name": "Idle NAT Gateways (< 1KB/hr processed for 14d)",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-02",
      "name": "Unused VPC Interface Endpoints (0 bytes for 14d)",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-03",
      "name": "ALBs with no healthy targets and < 100 req/day",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-04",
      "name": "Route53 hosted zones with only NS/SOA records ($0.50/mo each)",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-05",
      "name": "VPN connections with 0 tunnel state (disconnected)",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-06",
      "name": "Security groups not attached to any resource",
      "cloud": "aws",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-07",
      "name": "Network Load Balancers with 0 active flows",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-08",
      "name": "Route53 health checks not associated with any record",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-09",
      "name": "CloudFront distributions with 0 requests in 14 days",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-10",
      "name": "Direct Connect VIFs in 'available' state with 0 traffic",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-11",
      "name": "Transit Gateway attachments with 0 bytes for 14 days",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "net-12",
      "name": "AWS Global Accelerator with 0 traffic",
      "cloud": "aws",
      "service": "network_gateways",
      "category": "network",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-01",
      "name": "CloudWatch Log Groups with retention > 365 days",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-02",
      "name": "CloudWatch custom metrics with 0 data points in 30 days",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-03",
      "name": "CloudWatch alarms in INSUFFICIENT_DATA state for > 30 days",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-04",
      "name": "X-Ray sampling at 100% on high-traffic services (very expensive)",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-05",
      "name": "CloudTrail trails sending all events to high-cost S3+CW Logs",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-06",
      "name": "Log groups > 10GB with no S3 export configured",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-07",
      "name": "CloudWatch dashboards never viewed ($3/dashboard/month)",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-08",
      "name": "CloudWatch Contributor Insights rules running on high-volume tables",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-09",
      "name": "CloudWatch Evidently projects with running features (no events)",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "obs-10",
      "name": "Application Insights applications with no anomalies (over-monitored)",
      "cloud": "aws",
      "service": "observability",
      "category": "observability",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "opensearch-01",
      "name": "Idle OpenSearch Domains",
      "cloud": "aws",
      "service": "opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "opensearch-02",
      "name": "OpenSearch Domains on Previous Gen Instances",
      "cloud": "aws",
      "service": "opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "opensearch-03",
      "name": "OpenSearch Hot Storage for Cold Data (UltraWarm Candidate)",
      "cloud": "aws",
      "service": "opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "opensearch-04",
      "name": "OpenSearch Domains without Encryption at Rest",
      "cloud": "aws",
      "service": "opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "opensearch-05",
      "name": "OpenSearch Over-provisioned Cluster (Low CPU)",
      "cloud": "aws",
      "service": "opensearch",
      "category": "opensearch",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-03",
      "name": "Single-AZ RDS in production (availability risk)",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-04",
      "name": "RDS manual snapshots older than 30 days",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-05",
      "name": "Publicly accessible RDS instances (security + cost risk)",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-08",
      "name": "Unused RDS parameter groups",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-09",
      "name": "RDS instances with storage autoscaling threshold never triggered",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-10",
      "name": "RDS instances with no cost allocation tags",
      "cloud": "aws",
      "service": "rds_governance",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-01",
      "name": "Idle RDS instances (0 connections for 14 days)",
      "cloud": "aws",
      "service": "rds_provisioning",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-02",
      "name": "Over-provisioned RDS (CPU < 10% for 14d)",
      "cloud": "aws",
      "service": "rds_provisioning",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-06",
      "name": "Idle RDS Proxy endpoints (0 client connections)",
      "cloud": "aws",
      "service": "rds_provisioning",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "rds-07",
      "name": "Aurora clusters with < 2 reader instances (no read scaling)",
      "cloud": "aws",
      "service": "rds_provisioning",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-01",
      "name": "Idle Redshift Clusters",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-02",
      "name": "Provisioned Redshift Cluster (No Auto-Pause)",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-03",
      "name": "Stale Redshift Manual Snapshots (>30 days)",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-04",
      "name": "Redshift DC1/DS2 (Previous Gen Nodes)",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-05",
      "name": "Redshift Single-Node in Production (No HA)",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "info",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "redshift-06",
      "name": "Unused Redshift Reserved Nodes",
      "cloud": "aws",
      "service": "redshift",
      "category": "redshift",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-01",
      "name": "S3 buckets with no lifecycle policy",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-02",
      "name": "S3 incomplete multipart uploads > 7 days",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-03",
      "name": "Large S3 buckets eligible for Intelligent-Tiering",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-04",
      "name": "Empty S3 buckets with versioning enabled (delete markers billing)",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-05",
      "name": "S3 cross-region replication on cold buckets (unnecessary data transfer)",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-06",
      "name": "S3 Transfer Acceleration enabled but unused",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-07",
      "name": "S3 Requester Pays disabled on public data buckets",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-08",
      "name": "S3 Glacier Instant Retrieval for frequently accessed data",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-09",
      "name": "S3 server access logging writing to same-account bucket (log spam)",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "s3-10",
      "name": "S3 buckets without cost allocation tags",
      "cloud": "aws",
      "service": "s3",
      "category": "s3",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-01",
      "name": "Savings Plan coverage < 80% of eligible spend",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-02",
      "name": "Reserved Instance utilization < 70%",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-03",
      "name": "No AWS Budget alerts configured",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-04",
      "name": "EC2 instances missing cost allocation tags",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-05",
      "name": "Unresolved cost anomalies > 7 days old",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-06",
      "name": "Secrets Manager secrets not accessed in 30 days ($0.40/mo each)",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "low",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-07",
      "name": "WAF WebACLs with 0 blocked/allowed requests",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-08",
      "name": "Compute Optimizer recommendations with high savings not actioned",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-09",
      "name": "GuardDuty HIGH findings not actioned > 7 days (cost risk)",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "sup-10",
      "name": "High inter-region data transfer cost (> $50/month)",
      "cloud": "aws",
      "service": "support",
      "category": "support",
      "surface": "operational",
      "severity": "high",
      "evidence_type": "heuristic",
      "lifecycle_status": "production_ga",
      "detection_mode": "agentless_api",
      "remediation_capability": "autonomous_with_rollback",
      "requires_agent": false
    },
    {
      "id": "azure-app-service-manual-cert",
      "name": "Azure App Service Paid Certificate (Free Managed Certificate Available)",
      "cloud": "azure",
      "service": "ai_observability",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-databricks-idle-cluster",
      "name": "Azure Databricks Interactive Cluster Without Auto-Termination",
      "cloud": "azure",
      "service": "ai_observability",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-log-analytics-retention",
      "name": "Azure Log Analytics Workspace Uncapped Ingestion / Retention",
      "cloud": "azure",
      "service": "ai_observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-openai-idle-ptu",
      "name": "Azure OpenAI Underutilized Provisioned Throughput (PTU)",
      "cloud": "azure",
      "service": "ai_observability",
      "category": "ml",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-backup-policy-excessive-frequency",
      "name": "Excessive Backup Snapshot Frequency on Non-Production Workloads",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "backup",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-blob-immutable-waste",
      "name": "Azure Blob Container Immutable Policy Expired Without Deletion Lifecycle",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-disk-bursting-unneeded",
      "name": "Azure Managed Disk On-Demand Bursting Enabled with Zero Burst Credit Consumption",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-elastic-san-overallocated",
      "name": "Azure Elastic SAN Storage Pool Provisioned Without Active Volume Targets",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-file-share-large-provisioned-quota",
      "name": "Azure Premium File Share Provisioned Quota Significantly Exceeding Consumption",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-recovery-services-vault-orphaned",
      "name": "Azure Recovery Services Vault Retaining Backups of Terminated Resources",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "backup",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-storage-account-v1-deprecated",
      "name": "Legacy General-Purpose v1 (GPv1) Storage Account Missing Cool/Archive Tiering",
      "cloud": "azure",
      "service": "backup_recovery",
      "category": "s3",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-dormant-app-service",
      "name": "Azure Dormant App Service Plan",
      "cloud": "azure",
      "service": "compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-vm",
      "name": "Azure Idle Virtual Machine",
      "cloud": "azure",
      "service": "compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-stopped-allocated-vm",
      "name": "Azure Stopped (Allocated) VM Incurring Compute Charges",
      "cloud": "azure",
      "service": "compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-aks-node-underutilized",
      "name": "Azure AKS Node Pool Underutilization",
      "cloud": "azure",
      "service": "compute_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-avd-unassigned-hosts",
      "name": "Azure Virtual Desktop Unassigned Session Host",
      "cloud": "azure",
      "service": "compute_rightsizer",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-burstable-b-series",
      "name": "Azure Burstable B-Series Rightsizing Candidate",
      "cloud": "azure",
      "service": "compute_rightsizer",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-functions-dedicated-plan",
      "name": "Azure Functions on Overprovisioned Dedicated Plan",
      "cloud": "azure",
      "service": "compute_rightsizer",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-old-vm-generation",
      "name": "Azure Legacy VM Generation Upgrade Candidate",
      "cloud": "azure",
      "service": "compute_rightsizer",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-cosmos-provisioned-ru",
      "name": "Azure Cosmos DB Overprovisioned Manual RU/s",
      "cloud": "azure",
      "service": "database",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-sql-overprovisioned-dtu",
      "name": "Azure SQL Overprovisioned DTU / vCore Allocation",
      "cloud": "azure",
      "service": "database",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-cosmos-autoscale-max-slack",
      "name": "Azure Cosmos DB Autoscale Max RU/s Substantially Overprovisioned",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-event-hub-throughput-units-idle",
      "name": "Azure Event Hub Dedicated Throughput Units (TUs) Completely Idle",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-mariadb-deprecated-sku",
      "name": "Azure MariaDB Instance on Deprecated End-of-Life Platform",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-postgres-flexible-idle-storage",
      "name": "Azure PostgreSQL Flexible Server Provisioned Storage Underutilized (< 10%)",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-service-bus-premium-slack",
      "name": "Azure Service Bus Premium Namespace Messaging Units Underutilized",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-sql-hyperscale-replica-waste",
      "name": "Azure SQL Hyperscale Extra HA Replicas Incurring Cost with Zero Read Workload",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-synapse-spark-pool-oversized",
      "name": "Azure Synapse Spark Pool Running Without Auto-Pause Configured",
      "cloud": "azure",
      "service": "database_advanced",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-postgres-burstable",
      "name": "Azure PostgreSQL Flexible Server Burstable Candidate",
      "cloud": "azure",
      "service": "database_elastic",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-redis-cache-idle",
      "name": "Azure Cache for Redis Idle Instance",
      "cloud": "azure",
      "service": "database_elastic",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-sql-elastic-pool-waste",
      "name": "Azure SQL Elastic Pool Overprovisioned Capacity",
      "cloud": "azure",
      "service": "database_elastic",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-synapse-unpaused",
      "name": "Azure Synapse Dedicated SQL Pool Unpaused Off-Hours",
      "cloud": "azure",
      "service": "database_elastic",
      "category": "redshift",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-zrs-storage-overprovisioned",
      "name": "Azure Storage Redundancy Overprovisioned (ZRS in Non-Prod)",
      "cloud": "azure",
      "service": "database_elastic",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-cognitive-search-overprovisioned",
      "name": "Azure AI Search Unit (SU) Allocation Substantially Exceeding Peak Query Load",
      "cloud": "azure",
      "service": "managed_ai_platforms",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-databricks-photon-unutilized",
      "name": "Azure Databricks Cluster With Expensive Photon Surcharge on Ineligible Workloads",
      "cloud": "azure",
      "service": "managed_ai_platforms",
      "category": "emr",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-app-gateway",
      "name": "Azure Idle Application Gateway",
      "cloud": "azure",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-unassociated-pip",
      "name": "Azure Unassociated Public IP Address",
      "cloud": "azure",
      "service": "network",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-bastion-host",
      "name": "Azure Idle Bastion Host",
      "cloud": "azure",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-nat-gateway",
      "name": "Azure Idle Virtual Network NAT Gateway",
      "cloud": "azure",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-traffic-manager",
      "name": "Azure Idle Traffic Manager Profile",
      "cloud": "azure",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-idle-vpn-gateway",
      "name": "Azure Idle Virtual Network Gateway",
      "cloud": "azure",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-unused-expressroute",
      "name": "Azure Unused ExpressRoute Circuit",
      "cloud": "azure",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-dns-private-zone-orphaned",
      "name": "Azure Private DNS Zone Retained with Zero VNet Virtual Links",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-firewall-idle-capacity",
      "name": "Azure Firewall Provisioned with Sustained Minimal Throughput (< 1 GB/14d)",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-front-door-unused-waf",
      "name": "Azure Front Door Premium SKU Without Active WAF Custom Rules",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-private-endpoint-zombie",
      "name": "Azure Private Endpoint Disconnected from Backing Resource",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-route-table-unused",
      "name": "Azure Route Table Unassociated with Subnets",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-virtual-wan-idle-hub",
      "name": "Azure Virtual WAN Hub Provisioned Without Active Connections",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-vnet-peering-cross-region-leak",
      "name": "Excessive Cross-Region VNet Peering Incurring Premium Data Transfer Charges",
      "cloud": "azure",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-app-service-vnet-egress",
      "name": "Azure App Service Routing Storage/DB Calls Over Public Egress",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-batch-pool-zombie",
      "name": "Azure Batch Pool Dedicated Nodes Retained with No Scheduled Tasks",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-container-apps-idle-replicas",
      "name": "Azure Container Apps Provisioned with Idle Minimum Replicas",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-event-grid-failed-deliveries",
      "name": "Azure Event Grid High Dead-Letter Delivery Drop Ratio",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "lambda",
      "surface": "anomaly",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-keyvault-hsm-unused",
      "name": "Azure Key Vault Managed HSM Pool Retained with Minimal Key Inventory",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "iam",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-logic-apps-standard-idle",
      "name": "Azure Logic Apps Standard Dedicated Plan Running Without Workflow Invocations",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-spring-apps-overprovisioned",
      "name": "Azure Spring Apps Allocation Significantly Overprovisioned",
      "cloud": "azure",
      "service": "serverless_microservices",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-blob-lifecycle-tiering",
      "name": "Azure Blob Storage Tiering Candidate (Hot to Cool/Archive)",
      "cloud": "azure",
      "service": "storage",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-blob-soft-delete-waste",
      "name": "Azure Blob Soft-Delete Excessive Retention",
      "cloud": "azure",
      "service": "storage",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-netapp-overprovisioned",
      "name": "Azure NetApp Files Capacity Pool Overprovisioned",
      "cloud": "azure",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-orphaned-disk-snapshot",
      "name": "Azure Orphaned Managed Disk Snapshot",
      "cloud": "azure",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-premium-ssd-underutilized",
      "name": "Azure Premium SSD Underutilized IOPS",
      "cloud": "azure",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "azure-unattached-managed-disk",
      "name": "Azure Unattached Managed Disk",
      "cloud": "azure",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-logging-retention",
      "name": "GCP Cloud Logging Unbounded Log Retention",
      "cloud": "gcp",
      "service": "ai_observability",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-dataflow-stuck-job",
      "name": "GCP Dataflow Stuck Zero-Throughput Streaming Job",
      "cloud": "gcp",
      "service": "ai_observability",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-dataproc-idle-cluster",
      "name": "GCP Dataproc Idle Hadoop/Spark Cluster",
      "cloud": "gcp",
      "service": "ai_observability",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-vertex-ai-idle-endpoint",
      "name": "GCP Vertex AI Idle Prediction Endpoint",
      "cloud": "gcp",
      "service": "ai_observability",
      "category": "ml",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-bigquery-unpartitioned-scans",
      "name": "GCP BigQuery Unpartitioned Full Table Scans",
      "cloud": "gcp",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-bigquery-unutilized-slots",
      "name": "GCP BigQuery Unutilized Slot Commitment",
      "cloud": "gcp",
      "service": "analytics",
      "category": "analytics",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-detached-static-ip",
      "name": "GCP Detached External Static IP",
      "cloud": "gcp",
      "service": "compute",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-idle-gce-instance",
      "name": "GCP Idle Compute Engine Instance",
      "cloud": "gcp",
      "service": "compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-functions-over-allocated",
      "name": "GCP Cloud Functions Over-Allocated Memory",
      "cloud": "gcp",
      "service": "compute_rightsizer",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-run-min-instances",
      "name": "GCP Cloud Run Idle Warm Min-Instances",
      "cloud": "gcp",
      "service": "compute_rightsizer",
      "category": "lambda",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-custom-machine-rightsizer",
      "name": "GCP Custom Machine Type Rightsizing Candidate",
      "cloud": "gcp",
      "service": "compute_rightsizer",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-gke-node-underutilized",
      "name": "GKE Node Pool Underutilized Capacity",
      "cloud": "gcp",
      "service": "compute_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-legacy-machine-type",
      "name": "GCP Legacy Machine Type Upgrade Candidate (N1/G1 to E2)",
      "cloud": "gcp",
      "service": "compute_rightsizer",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-idle-cloud-sql",
      "name": "GCP Idle Cloud SQL Database",
      "cloud": "gcp",
      "service": "database",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-spanner-overprovisioned-nodes",
      "name": "GCP Cloud Spanner Overprovisioned Nodes",
      "cloud": "gcp",
      "service": "database",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-alloydb-overprovisioned",
      "name": "GCP AlloyDB Read Pool Overprovisioned Capacity",
      "cloud": "gcp",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-bigtable-underutilized",
      "name": "GCP Cloud Bigtable Cluster Underutilized CPU",
      "cloud": "gcp",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-sql-dev-ha",
      "name": "GCP Cloud SQL High-Availability Standby in Dev/Test",
      "cloud": "gcp",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-sql-storage-overprovisioned",
      "name": "GCP Cloud SQL Overprovisioned Disk Capacity",
      "cloud": "gcp",
      "service": "database_advanced",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-memorystore-redis-idle",
      "name": "GCP Memorystore for Redis Idle Instance",
      "cloud": "gcp",
      "service": "database_advanced",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-bigquery-bi-engine-underutilized",
      "name": "GCP BigQuery BI Engine Memory Capacity Underutilized (< 10% Query Acceleration)",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "athena",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-dataflow-shuffle-high-disk",
      "name": "GCP Dataflow Batch Pipeline Lacking Cloud Dataflow Shuffle Service",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "emr",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-datastream-cdc-idle",
      "name": "GCP Datastream Stream Incurring Dedicated Hourly Surcharge with Zero Ingestion",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-firestore-unindexed-read-waste",
      "name": "GCP Cloud Firestore High Document Scan Waste from Unindexed Queries",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-memorystore-memcached-idle",
      "name": "GCP Memorystore for Memcached Cluster Retained with Zero Connections",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "cache",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-pubsub-lite-overprovisioned",
      "name": "GCP Pub/Sub Lite Reservation Throughput Capacity Overprovisioned",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "sqs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-pubsub-unacknowledged-backlog-storage",
      "name": "GCP Pub/Sub Subscription Accumulating Massive Unacknowledged Storage Backlog",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "sqs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-spanner-free-instance-upgrade-trap",
      "name": "GCP Cloud Spanner Instance Incurring Minimum Processing Unit Hourly Fee with 0 QPS",
      "cloud": "gcp",
      "service": "database_analytics",
      "category": "rds",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-vertex-pipeline-stuck",
      "name": "GCP Vertex AI Pipeline Run Stalled in Zombie State",
      "cloud": "gcp",
      "service": "managed_ai_platforms",
      "category": "ml",
      "surface": "ai",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-idle-cloud-nat",
      "name": "GCP Idle Cloud NAT Gateway",
      "cloud": "gcp",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-idle-cloud-vpn",
      "name": "GCP Idle Cloud VPN Gateway",
      "cloud": "gcp",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-idle-forwarding-rule",
      "name": "GCP Idle Forwarding Rule (Orphaned Load Balancer Frontend)",
      "cloud": "gcp",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-unused-cloud-armor",
      "name": "GCP Cloud Armor Unused Security Policy",
      "cloud": "gcp",
      "service": "network_advanced",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-unused-interconnect",
      "name": "GCP Unused Cloud Interconnect Attachment",
      "cloud": "gcp",
      "service": "network_advanced",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-dns-unused-forwarding",
      "name": "GCP Cloud DNS Forwarding Zone with Non-Responsive Upstream Nameservers",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-router-redundant-bgp",
      "name": "GCP Cloud Router Provisioned Without Active BGP Sessions",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-external-http-lb-quic-disabled",
      "name": "GCP External Application Load Balancer Missing QUIC/HTTP3 Optimization",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-hybrid-connectivity-spoke-idle",
      "name": "GCP Network Connectivity Center Spoke Attached to Inactive Gateway",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-network-service-tier-premium-waste",
      "name": "GCP Premium Network Tier Used on Batch/Backup Egress Eligible for Standard Tier",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-private-service-connect-idle",
      "name": "GCP Private Service Connect (PSC) Endpoint Idle",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-serverless-vpc-connector-idle",
      "name": "GCP Serverless VPC Access Connector Incurring Fixed Hourly Fees with No Traffic",
      "cloud": "gcp",
      "service": "network_enterprise",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-artifact-registry-duplicate-layers",
      "name": "GCP Artifact Registry Sprawl of Untagged Manifests and Duplicate Container Layers",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-build-private-worker-pool-idle",
      "name": "GCP Cloud Build Private Worker Pool Incurring Fixed Hourly Fees Without Builds",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-logging-exclusion-missing",
      "name": "GCP Cloud Logging Ingesting High-Volume Load Balancer Health Check Probes",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "observability",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-tasks-backoff-thrash",
      "name": "GCP Cloud Tasks Queue High Retry Thrashing Failure Rate",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "lambda",
      "surface": "anomaly",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-filestore-zombie-share",
      "name": "GCP Cloud Filestore NFS Instance Provisioned with No Connected Clients",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-secret-manager-stale-versions",
      "name": "GCP Secret Manager Retaining Excessive Disabled Secret Versions",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "iam",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-workstations-idle-running",
      "name": "GCP Cloud Workstation Running Idle Without Active Developer Session",
      "cloud": "gcp",
      "service": "serverless_compute",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-storage-multi-region-waste",
      "name": "Google Cloud Storage Multi-Region Waste for Regional Workloads",
      "cloud": "gcp",
      "service": "storage",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-storage-nearline",
      "name": "Google Cloud Storage Tiering Candidate (Standard to Nearline)",
      "cloud": "gcp",
      "service": "storage",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-extreme-pd-unutilized-iops",
      "name": "GCP Extreme Persistent Disk Underutilized IOPS",
      "cloud": "gcp",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-orphaned-disk-snapshot",
      "name": "GCP Orphaned Compute Disk Snapshot",
      "cloud": "gcp",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-storage-version-lifecycle-missing",
      "name": "Google Cloud Storage Versioning Missing Retention Rules",
      "cloud": "gcp",
      "service": "storage",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-unattached-persistent-disk",
      "name": "GCP Unattached Persistent Disk",
      "cloud": "gcp",
      "service": "storage",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-cloud-backup-dr-stale-appliance",
      "name": "GCP Backup and DR Management Appliance Retained Without Protected Workloads",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "backup",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-kms-hsm-key-version-proliferation",
      "name": "GCP Cloud KMS CloudHSM Key Retaining Excessive Active Key Versions",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "iam",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-pd-hyperdisk-unutilized-throughput",
      "name": "GCP Hyperdisk Extreme Volume Provisioned IOPS/Throughput Underutilized",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-snapshot-schedule-frequency-excess",
      "name": "GCP Compute Snapshot Schedule Frequency Excessive on Development Disks",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "backup",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-storage-autoclass-transition-slack",
      "name": "GCP Cloud Storage Bucket Lacking Autoclass Lifecycle Optimization",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "s3",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "usage",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-storage-regional-dual-region-waste",
      "name": "GCP Cloud Storage Dual-Region Surcharge on Non-Critical/Dev Buckets",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "s3",
      "surface": "governance",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "gcp-transfer-service-stuck-job",
      "name": "GCP Storage Transfer Service Job Stalled in Continuous Failure Loop",
      "cloud": "gcp",
      "service": "storage_advanced",
      "category": "transfer",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    },
    {
      "id": "k8s-crashloop-compute-drain",
      "name": "Kubernetes CrashLoopBackOff Compute Quota Drain",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-cross-az-traffic-egress",
      "name": "Kubernetes Unoptimized Cross-AZ Inter-Pod Traffic Egress",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-idle-loadbalancer-service",
      "name": "Kubernetes Idle LoadBalancer Service (0 Endpoints)",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-ingress-zombie-cert",
      "name": "Kubernetes Ingress Referencing Missing/Zombie TLS Secret",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-overprovisioned-coredns",
      "name": "Kubernetes Overprovisioned CoreDNS Deployment",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "network",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-stuck-cronjob-waste",
      "name": "Kubernetes Stuck Zombie CronJob Accumulating Pods",
      "cloud": "kubernetes",
      "service": "cluster_hygiene",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-spot-suitability",
      "name": "Kubernetes Stateless Workload Running on On-Demand Nodes",
      "cloud": "kubernetes",
      "service": "optimization",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-zombie-pvc",
      "name": "Kubernetes Unmounted Zombie PersistentVolumeClaim",
      "cloud": "kubernetes",
      "service": "optimization",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "heuristic",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-cpu-rightsizing",
      "name": "Kubernetes Pod CPU Rightsizing",
      "cloud": "kubernetes",
      "service": "rightsizing",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-memory-rightsizing",
      "name": "Kubernetes Pod Memory Rightsizing",
      "cloud": "kubernetes",
      "service": "rightsizing",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-namespace-waste",
      "name": "High Kubernetes Namespace Waste",
      "cloud": "kubernetes",
      "service": "rightsizing",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-local-pv-unmounted",
      "name": "Kubernetes Unmounted Local NVMe PersistentVolume",
      "cloud": "kubernetes",
      "service": "storage_optimization",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-orphaned-pv-retain",
      "name": "Kubernetes Released PersistentVolume Retain Waste",
      "cloud": "kubernetes",
      "service": "storage_optimization",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-storageclass-overprovisioned",
      "name": "Kubernetes High-IOPS StorageClass Used for Scratch/Build Volumes",
      "cloud": "kubernetes",
      "service": "storage_optimization",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-underutilized-pvc-volume",
      "name": "Kubernetes Underutilized PVC Storage Volume",
      "cloud": "kubernetes",
      "service": "storage_optimization",
      "category": "ebs",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-unused-secret-configmap",
      "name": "Kubernetes Unreferenced ConfigMap/Secret Sprawl",
      "cloud": "kubernetes",
      "service": "storage_optimization",
      "category": "misc",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-daemonset-overprovisioned",
      "name": "Kubernetes DaemonSet Inefficiently Scheduled on GPU/High-Cost Nodes",
      "cloud": "kubernetes",
      "service": "workload_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-hpa-thrashing",
      "name": "Kubernetes HPA Thrashing / Unstable Flapping",
      "cloud": "kubernetes",
      "service": "workload_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-idle-namespace",
      "name": "Kubernetes Idle/Abandoned Namespace",
      "cloud": "kubernetes",
      "service": "workload_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-missing-requests-limits",
      "name": "Kubernetes Pod Deployed Without Resource Requests/Limits",
      "cloud": "kubernetes",
      "service": "workload_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "configuration",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "k8s-resource-request-limit-slack",
      "name": "Kubernetes Pod Resource Request Slack (Over-Requested Capacity)",
      "cloud": "kubernetes",
      "service": "workload_rightsizer",
      "category": "containers",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "in_cluster_telemetry",
      "remediation_capability": "iac_manifest_patch",
      "requires_agent": false
    },
    {
      "id": "cross-cloud-idle",
      "name": "Cross-Cloud Idle Compute Resources",
      "cloud": "multicloud",
      "service": "cross_cloud_idle",
      "category": "ec2",
      "surface": "operational",
      "severity": "medium",
      "evidence_type": "metric",
      "lifecycle_status": "developer_preview",
      "detection_mode": "agentless_api",
      "remediation_capability": "read_only_telemetry",
      "requires_agent": false
    }
  ],
  "quarantined_audit_summary": [
    {
      "id": "oci-autonomous-db-weekend-idle",
      "reason": "Internal unannounced prototype: oci-autonomous-db-weekend-idle"
    },
    {
      "id": "oci-flex-compute-oversizing",
      "reason": "Internal unannounced prototype: oci-flex-compute-oversizing"
    },
    {
      "id": "oci-unattached-boot-volume",
      "reason": "Internal unannounced prototype: oci-unattached-boot-volume"
    },
    {
      "id": "oversized_volumes",
      "reason": "Internal FOCUS duplicate wrapper: oversized_volumes"
    },
    {
      "id": "unattached_volumes",
      "reason": "Internal FOCUS duplicate wrapper: unattached_volumes"
    }
  ]
}