diff --git a/prowler/__main__.py b/prowler/__main__.py index f120b8ed46..712e6ec363 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -6,10 +6,7 @@ from os import environ from colorama import Fore, Style -from prowler.config.config import ( - get_available_compliance_frameworks, - threat_detection_checks, -) +from prowler.config.config import get_available_compliance_frameworks from prowler.lib.banner import print_banner from prowler.lib.check.check import ( bulk_load_checks_metadata, @@ -173,12 +170,6 @@ def prowler(): if checks_from_resources: checks_to_execute = checks_to_execute.intersection(checks_from_resources) - # Only execute threat detection checks if threat-detection category is set - if "threat-detection" not in categories: - checks_to_execute = [ - check for check in checks_to_execute if check not in threat_detection_checks - ] - # Sort final check list checks_to_execute = sorted(checks_to_execute) diff --git a/prowler/config/config.py b/prowler/config/config.py index f4058c95f3..9efa9ad320 100644 --- a/prowler/config/config.py +++ b/prowler/config/config.py @@ -27,12 +27,6 @@ valid_severities = ["critical", "high", "medium", "low", "informational"] # Compliance actual_directory = pathlib.Path(os.path.dirname(os.path.realpath(__file__))) -# AWS CloudTrail Threat Detection checks -threat_detection_checks = [ - "cloudtrail_threat_detection_privilege_escalation", - "cloudtrail_threat_detection_enumeration", -] - def get_available_compliance_frameworks(provider=None): available_compliance_frameworks = [] diff --git a/prowler/lib/check/checks_loader.py b/prowler/lib/check/checks_loader.py index e33eabafae..4c290df161 100644 --- a/prowler/lib/check/checks_loader.py +++ b/prowler/lib/check/checks_loader.py @@ -99,6 +99,11 @@ def load_checks_to_execute( check_name = check_info[0] checks_to_execute.add(check_name) + # Only execute threat detection checks if threat-detection category is set + if "threat-detection" not in categories: + for threat_detection_check in check_categories["threat-detection"]: + checks_to_execute.discard(threat_detection_check) + # Check Aliases checks_to_execute = update_checks_to_execute_with_aliases( checks_to_execute, check_aliases