ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

poc: examples API token notebooks in DEV

Browse Source
This commit is contained in:
Andoni A.
2025-10-22 15:21:53 +02:00
parent 6716c4ae73
commit 481a2defc9
2 changed files with 98 additions and 594 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/api/api-key-bash.ipynb
+50 -297
View File
@@ -34,7 +34,7 @@
},
{
"cell_type": "code",
"execution_count": 5,
"execution_count": 1,
"id": "cell-3",
"metadata": {},
"outputs": [
@@ -70,7 +70,7 @@
},
{
"cell_type": "code",
"execution_count": 6,
"execution_count": 2,
"id": "cell-6",
"metadata": {},
"outputs": [
@@ -80,7 +80,7 @@
"text": [
" % Total % Received % Xferd Average Speed Time Time Time Current\n",
" Dload Upload Total Spent Left Speed\n",
"100 5647 100 5647 0 0 1467 0 0:00:03 0:00:03 --:--:-- 1467\n"
"100 1398 100 1398 0 0 2723 0 --:--:-- --:--:-- --:--:-- 2719\n"
]
},
{
@@ -90,155 +90,30 @@
"{\n",
" \"links\": {\n",
" \"first\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n",
" \"next\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n",
" \"next\": null,\n",
" \"prev\": null\n",
" },\n",
" \"data\": [\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"50af9045-023a-4390-b2a6-7e08bb482c7e\",\n",
" \"id\": \"46a9435b-a2f6-44ee-b267-710f8a403ace\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-21T14:13:18.925063Z\",\n",
" \"updated_at\": \"2025-10-21T15:09:54.262401Z\",\n",
" \"provider\": \"m365\",\n",
" \"uid\": \"prowler.com\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-10-21T15:09:54.257607Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"d7308e68-ab2e-4c22-b388-e5005a5fc57d\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/50af9045-023a-4390-b2a6-7e08bb482c7e\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"e3bf0cb7-791f-42fd-9d19-b6d7db72290a\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-13T09:56:07.101323Z\",\n",
" \"updated_at\": \"2025-10-13T10:43:55.963669Z\",\n",
" \"provider\": \"gcp\",\n",
" \"uid\": \"empty-project-465413\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-10-13T10:43:55.959115Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"52f16eeb-14d6-46b8-9c97-a283e5386ac2\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/e3bf0cb7-791f-42fd-9d19-b6d7db72290a\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"53237f83-5c4d-45e4-82f3-aa9da4bbbe00\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-07T13:57:15.884120Z\",\n",
" \"updated_at\": \"2025-10-07T13:57:15.884136Z\",\n",
" \"provider\": \"gcp\",\n",
" \"uid\": \"test-posthog\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/53237f83-5c4d-45e4-82f3-aa9da4bbbe00\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"8c776ad5-d2ff-4574-bd41-753dbbd35bec\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-01T14:18:04.872628Z\",\n",
" \"updated_at\": \"2025-10-01T14:18:04.872644Z\",\n",
" \"inserted_at\": \"2025-10-22T07:46:12.089159Z\",\n",
" \"updated_at\": \"2025-10-22T08:00:04.923849Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789122\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"b56191d1-328e-42ee-a0f3-1422bf3dca9f\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/8c776ad5-d2ff-4574-bd41-753dbbd35bec\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"09f9949d-e801-4865-803d-51c8ee9c70f5\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-28T06:57:15.819206Z\",\n",
" \"updated_at\": \"2025-09-25T14:33:14.763507Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"dTroop3r\",\n",
" \"alias\": \"GH using App\",\n",
" \"uid\": \"552455647653\",\n",
" \"alias\": \"Prowler Demo\",\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-09-25T14:33:14.757995Z\"\n",
" \"last_checked_at\": \"2025-10-22T08:00:04.918455Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"6ade14ed-0113-4b42-955c-c0159315821a\"\n",
" \"id\": \"49fafccd-348f-47c1-9147-3494903290ff\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
@@ -249,28 +124,28 @@
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/09f9949d-e801-4865-803d-51c8ee9c70f5\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/46a9435b-a2f6-44ee-b267-710f8a403ace\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"d664cb20-3cc8-403d-9d62-0773c61642d7\",\n",
" \"id\": \"9e499bb1-03fd-4588-b58a-75ef71334040\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-28T06:48:40.344590Z\",\n",
" \"updated_at\": \"2025-08-28T09:53:07.955423Z\",\n",
" \"inserted_at\": \"2025-10-22T07:42:53.856378Z\",\n",
" \"updated_at\": \"2025-10-22T07:46:15.197305Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"PieceOfM1nd\",\n",
" \"alias\": \"PieceOfM1nd (org)\",\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-08-28T09:53:07.949871Z\"\n",
" \"last_checked_at\": \"2025-10-22T07:46:15.191930Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"ca7d8494-069b-4388-9d02-3310b96c6fbd\"\n",
" \"id\": \"3aa2c451-34e3-48c4-a0d6-db532181c892\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
@@ -281,137 +156,15 @@
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/d664cb20-3cc8-403d-9d62-0773c61642d7\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"00acd090-ad97-4182-91d2-f279502fb3eb\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-21T16:35:31.030729Z\",\n",
" \"updated_at\": \"2025-08-21T17:14:25.890660Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789111\",\n",
" \"alias\": \"Test role bug\",\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"332bea53-6381-484d-83ed-ca1ccc52dd76\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/00acd090-ad97-4182-91d2-f279502fb3eb\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"dcf3bc9c-102c-4f47-9753-3732a70601d7\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-21T16:21:18.013721Z\",\n",
" \"updated_at\": \"2025-08-21T16:21:18.013738Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789012\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/dcf3bc9c-102c-4f47-9753-3732a70601d7\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"2642ea99-cd32-463c-a7e9-8b7791f8f7e5\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-09T07:54:03.128579Z\",\n",
" \"updated_at\": \"2025-08-09T07:54:03.128594Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"pedrooot\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/2642ea99-cd32-463c-a7e9-8b7791f8f7e5\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"bc7a6295-f706-4361-855d-2352829b6668\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-04T12:36:34.699122Z\",\n",
" \"updated_at\": \"2025-10-21T12:38:42.660182Z\",\n",
" \"provider\": \"kubernetes\",\n",
" \"uid\": \"arn:aws:eks:eu-west-1:106908755756:cluster/test\",\n",
" \"alias\": \"EKS Dev\",\n",
" \"connection\": {\n",
" \"connected\": false,\n",
" \"last_checked_at\": \"2025-10-21T12:38:42.655786Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"52471ba2-27de-4570-a762-aee33bc3f44c\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/bc7a6295-f706-4361-855d-2352829b6668\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/9e499bb1-03fd-4588-b58a-75ef71334040\"\n",
" }\n",
" }\n",
" ],\n",
" \"meta\": {\n",
" \"pagination\": {\n",
" \"page\": 1,\n",
" \"pages\": 2,\n",
" \"count\": 16\n",
" \"pages\": 1,\n",
" \"count\": 2\n",
" },\n",
" \"version\": \"v1\"\n",
" }\n",
@@ -439,7 +192,7 @@
},
{
"cell_type": "code",
"execution_count": 7,
"execution_count": 3,
"id": "xkmbmm7rywb",
"metadata": {},
"outputs": [
@@ -449,7 +202,7 @@
"text": [
" % Total % Received % Xferd Average Speed Time Time Time Current\n",
" Dload Upload Total Spent Left Speed\n",
"100 3170 100 3170 0 0 2041 0 0:00:01 0:00:01 --:--:-- 2041\n"
"100 2465 100 2465 0 0 4558 0 --:--:-- --:--:-- --:--:-- 4556\n"
]
},
{
@@ -459,60 +212,60 @@
"{\n",
" \"links\": {\n",
" \"first\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=1&page%5Bsize%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=946&page%5Bsize%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=138&page%5Bsize%5D=1\",\n",
" \"next\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=2&page%5Bsize%5D=1\",\n",
" \"prev\": null\n",
" },\n",
" \"data\": [\n",
" {\n",
" \"type\": \"findings\",\n",
" \"id\": \"019a0753-1e4b-7229-bb7d-91eab8fc0f4f\",\n",
" \"id\": \"019a0af5-e65a-7735-8223-e9aa5ab4c58e\",\n",
" \"attributes\": {\n",
" \"uid\": \"prowler-m365-teams_unmanaged_communication_disabled-f4dffefa-083f-4e9e-91e0-5d1e04f4b72b-global-Teams User Settings\",\n",
" \"uid\": \"prowler-aws-ssm_document_secrets-552455647653-us-east-1-SSM-SessionManagerRunShell\",\n",
" \"delta\": \"new\",\n",
" \"status\": \"PASS\",\n",
" \"status_extended\": \"Teams users cannot communicate with unmanaged users.\",\n",
" \"status_extended\": \"No secrets found in SSM Document SSM-SessionManagerRunShell.\",\n",
" \"severity\": \"critical\",\n",
" \"check_id\": \"teams_unmanaged_communication_disabled\",\n",
" \"check_id\": \"ssm_document_secrets\",\n",
" \"check_metadata\": {\n",
" \"risk\": \"Allowing communication with unmanaged Microsoft Teams users increases the risk of targeted attacks such as phishing, malware distribution (e.g., DarkGate), and exploitation techniques like GIFShell and username enumeration. Unmanaged accounts are easier for threat actors to create and use as attack vectors.\",\n",
" \"risk\": \"Secrets hardcoded into SSM Documents by malware and bad actors to gain lateral access to other services.\",\n",
" \"notes\": \"\",\n",
" \"checkid\": \"teams_unmanaged_communication_disabled\",\n",
" \"provider\": \"m365\",\n",
" \"checkid\": \"ssm_document_secrets\",\n",
" \"provider\": \"aws\",\n",
" \"severity\": \"critical\",\n",
" \"checktype\": [],\n",
" \"dependson\": [],\n",
" \"relatedto\": [],\n",
" \"categories\": [\n",
" \"e3\"\n",
" \"secrets\"\n",
" ],\n",
" \"checktitle\": \"Ensure unmanaged communication is disabled.\",\n",
" \"checktitle\": \"Find secrets in SSM Documents.\",\n",
" \"compliance\": [],\n",
" \"relatedurl\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n",
" \"description\": \"Ensure unmanaged communication is disabled in Teams admin center.\",\n",
" \"relatedurl\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n",
" \"description\": \"Find secrets in SSM Documents.\",\n",
" \"remediation\": {\n",
" \"code\": {\n",
" \"cli\": \"Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false\",\n",
" \"other\": \"1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Click to expand Users select External access. 3. Scroll to Teams accounts not managed by an organization. 4. Set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to Off. 5. Click Save.\",\n",
" \"cli\": \"\",\n",
" \"other\": \"\",\n",
" \"nativeiac\": \"\",\n",
" \"terraform\": \"\"\n",
" },\n",
" \"recommendation\": {\n",
" \"url\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n",
" \"text\": \"Disable communication with Teams users whose accounts aren't managed by an organization by setting 'People in my organization can communicate with Teams users whose accounts aren't managed by an organization' to Off. This helps prevent unauthorized or risky external interactions.\"\n",
" \"url\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n",
" \"text\": \"Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use Secrets Manager service to store and retrieve passwords and secrets.\"\n",
" }\n",
" },\n",
" \"servicename\": \"teams\",\n",
" \"servicename\": \"ssm\",\n",
" \"checkaliases\": [],\n",
" \"resourcetype\": \"Teams Settings\",\n",
" \"resourcetype\": \"AwsSsmDocument\",\n",
" \"additionalurls\": [],\n",
" \"subservicename\": \"\",\n",
" \"resourceidtemplate\": \"\"\n",
" \"resourceidtemplate\": \"arn:aws:ssm:region:account-id:document/document-name\"\n",
" },\n",
" \"raw_result\": {},\n",
" \"inserted_at\": \"2025-10-21T15:11:19.115828Z\",\n",
" \"updated_at\": \"2025-10-21T15:11:19.120405Z\",\n",
" \"first_seen_at\": \"2025-10-21T15:11:19.113770Z\",\n",
" \"inserted_at\": \"2025-10-22T08:07:58.811165Z\",\n",
" \"updated_at\": \"2025-10-22T08:07:58.818764Z\",\n",
" \"first_seen_at\": \"2025-10-22T08:07:58.808707Z\",\n",
" \"muted\": false,\n",
" \"muted_reason\": null\n",
" },\n",
@@ -520,7 +273,7 @@
" \"scan\": {\n",
" \"data\": {\n",
" \"type\": \"scans\",\n",
" \"id\": \"019a074f-e8c1-74b9-84e6-95a821f7ac30\"\n",
" \"id\": \"019a0aec-edbc-7815-8476-b4efb7a4059a\"\n",
" }\n",
" },\n",
" \"resources\": {\n",
@@ -530,21 +283,21 @@
" \"data\": [\n",
" {\n",
" \"type\": \"resources\",\n",
" \"id\": \"3455f95f-f985-48c4-ac34-d22baac19aa3\"\n",
" \"id\": \"f1f89f3d-22f8-43f6-a912-4edb23a7522a\"\n",
" }\n",
" ]\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0753-1e4b-7229-bb7d-91eab8fc0f4f\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0af5-e65a-7735-8223-e9aa5ab4c58e\"\n",
" }\n",
" }\n",
" ],\n",
" \"meta\": {\n",
" \"pagination\": {\n",
" \"page\": 1,\n",
" \"pages\": 946,\n",
" \"count\": 946\n",
" \"pages\": 138,\n",
" \"count\": 138\n",
" },\n",
" \"version\": \"v1\"\n",
" }\n",
examples/api/api-key.ipynb
+48 -297
View File
@@ -31,7 +31,7 @@
},
{
"cell_type": "code",
"execution_count": 8,
"execution_count": 1,
"metadata": {},
"outputs": [],
"source": [
@@ -56,7 +56,7 @@
},
{
"cell_type": "code",
"execution_count": 9,
"execution_count": 2,
"metadata": {},
"outputs": [
{
@@ -66,155 +66,30 @@
"{\n",
" \"links\": {\n",
" \"first\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n",
" \"next\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n",
" \"next\": null,\n",
" \"prev\": null\n",
" },\n",
" \"data\": [\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"50af9045-023a-4390-b2a6-7e08bb482c7e\",\n",
" \"id\": \"46a9435b-a2f6-44ee-b267-710f8a403ace\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-21T14:13:18.925063Z\",\n",
" \"updated_at\": \"2025-10-21T15:09:54.262401Z\",\n",
" \"provider\": \"m365\",\n",
" \"uid\": \"prowler.com\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-10-21T15:09:54.257607Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"d7308e68-ab2e-4c22-b388-e5005a5fc57d\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/50af9045-023a-4390-b2a6-7e08bb482c7e\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"e3bf0cb7-791f-42fd-9d19-b6d7db72290a\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-13T09:56:07.101323Z\",\n",
" \"updated_at\": \"2025-10-13T10:43:55.963669Z\",\n",
" \"provider\": \"gcp\",\n",
" \"uid\": \"empty-project-465413\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-10-13T10:43:55.959115Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"52f16eeb-14d6-46b8-9c97-a283e5386ac2\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/e3bf0cb7-791f-42fd-9d19-b6d7db72290a\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"53237f83-5c4d-45e4-82f3-aa9da4bbbe00\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-07T13:57:15.884120Z\",\n",
" \"updated_at\": \"2025-10-07T13:57:15.884136Z\",\n",
" \"provider\": \"gcp\",\n",
" \"uid\": \"test-posthog\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/53237f83-5c4d-45e4-82f3-aa9da4bbbe00\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"8c776ad5-d2ff-4574-bd41-753dbbd35bec\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-10-01T14:18:04.872628Z\",\n",
" \"updated_at\": \"2025-10-01T14:18:04.872644Z\",\n",
" \"inserted_at\": \"2025-10-22T07:46:12.089159Z\",\n",
" \"updated_at\": \"2025-10-22T08:00:04.923849Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789122\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"b56191d1-328e-42ee-a0f3-1422bf3dca9f\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/8c776ad5-d2ff-4574-bd41-753dbbd35bec\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"09f9949d-e801-4865-803d-51c8ee9c70f5\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-28T06:57:15.819206Z\",\n",
" \"updated_at\": \"2025-09-25T14:33:14.763507Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"dTroop3r\",\n",
" \"alias\": \"GH using App\",\n",
" \"uid\": \"552455647653\",\n",
" \"alias\": \"Prowler Demo\",\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-09-25T14:33:14.757995Z\"\n",
" \"last_checked_at\": \"2025-10-22T08:00:04.918455Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"6ade14ed-0113-4b42-955c-c0159315821a\"\n",
" \"id\": \"49fafccd-348f-47c1-9147-3494903290ff\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
@@ -225,28 +100,28 @@
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/09f9949d-e801-4865-803d-51c8ee9c70f5\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/46a9435b-a2f6-44ee-b267-710f8a403ace\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"d664cb20-3cc8-403d-9d62-0773c61642d7\",\n",
" \"id\": \"9e499bb1-03fd-4588-b58a-75ef71334040\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-28T06:48:40.344590Z\",\n",
" \"updated_at\": \"2025-08-28T09:53:07.955423Z\",\n",
" \"inserted_at\": \"2025-10-22T07:42:53.856378Z\",\n",
" \"updated_at\": \"2025-10-22T07:46:15.197305Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"PieceOfM1nd\",\n",
" \"alias\": \"PieceOfM1nd (org)\",\n",
" \"connection\": {\n",
" \"connected\": true,\n",
" \"last_checked_at\": \"2025-08-28T09:53:07.949871Z\"\n",
" \"last_checked_at\": \"2025-10-22T07:46:15.191930Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"ca7d8494-069b-4388-9d02-3310b96c6fbd\"\n",
" \"id\": \"3aa2c451-34e3-48c4-a0d6-db532181c892\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
@@ -257,137 +132,15 @@
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/d664cb20-3cc8-403d-9d62-0773c61642d7\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"00acd090-ad97-4182-91d2-f279502fb3eb\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-21T16:35:31.030729Z\",\n",
" \"updated_at\": \"2025-08-21T17:14:25.890660Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789111\",\n",
" \"alias\": \"Test role bug\",\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"332bea53-6381-484d-83ed-ca1ccc52dd76\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/00acd090-ad97-4182-91d2-f279502fb3eb\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"dcf3bc9c-102c-4f47-9753-3732a70601d7\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-21T16:21:18.013721Z\",\n",
" \"updated_at\": \"2025-08-21T16:21:18.013738Z\",\n",
" \"provider\": \"aws\",\n",
" \"uid\": \"123456789012\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/dcf3bc9c-102c-4f47-9753-3732a70601d7\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"2642ea99-cd32-463c-a7e9-8b7791f8f7e5\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-09T07:54:03.128579Z\",\n",
" \"updated_at\": \"2025-08-09T07:54:03.128594Z\",\n",
" \"provider\": \"github\",\n",
" \"uid\": \"pedrooot\",\n",
" \"alias\": null,\n",
" \"connection\": {\n",
" \"connected\": null,\n",
" \"last_checked_at\": null\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": null\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/2642ea99-cd32-463c-a7e9-8b7791f8f7e5\"\n",
" }\n",
" },\n",
" {\n",
" \"type\": \"providers\",\n",
" \"id\": \"bc7a6295-f706-4361-855d-2352829b6668\",\n",
" \"attributes\": {\n",
" \"inserted_at\": \"2025-08-04T12:36:34.699122Z\",\n",
" \"updated_at\": \"2025-10-21T12:38:42.660182Z\",\n",
" \"provider\": \"kubernetes\",\n",
" \"uid\": \"arn:aws:eks:eu-west-1:106908755756:cluster/test\",\n",
" \"alias\": \"EKS Dev\",\n",
" \"connection\": {\n",
" \"connected\": false,\n",
" \"last_checked_at\": \"2025-10-21T12:38:42.655786Z\"\n",
" }\n",
" },\n",
" \"relationships\": {\n",
" \"secret\": {\n",
" \"data\": {\n",
" \"type\": \"provider-secrets\",\n",
" \"id\": \"52471ba2-27de-4570-a762-aee33bc3f44c\"\n",
" }\n",
" },\n",
" \"provider_groups\": {\n",
" \"meta\": {\n",
" \"count\": 0\n",
" },\n",
" \"data\": []\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/bc7a6295-f706-4361-855d-2352829b6668\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/providers/9e499bb1-03fd-4588-b58a-75ef71334040\"\n",
" }\n",
" }\n",
" ],\n",
" \"meta\": {\n",
" \"pagination\": {\n",
" \"page\": 1,\n",
" \"pages\": 2,\n",
" \"count\": 16\n",
" \"pages\": 1,\n",
" \"count\": 2\n",
" },\n",
" \"version\": \"v1\"\n",
" }\n",
@@ -400,8 +153,6 @@
"import os\n",
"import json\n",
"\n",
"prowler_api_key = os.environ.get('PROWLER_API_KEY')\n",
"\n",
"headers = {\n",
" 'Authorization': f'Api-Key {prowler_api_key}',\n",
" 'Content-Type': 'application/vnd.api+json'\n",
@@ -425,7 +176,7 @@
},
{
"cell_type": "code",
"execution_count": 10,
"execution_count": 3,
"metadata": {},
"outputs": [
{
@@ -435,60 +186,60 @@
"{\n",
" \"links\": {\n",
" \"first\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=1&page%5Bsize%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=946&page%5Bsize%5D=1\",\n",
" \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=138&page%5Bsize%5D=1\",\n",
" \"next\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=2&page%5Bsize%5D=1\",\n",
" \"prev\": null\n",
" },\n",
" \"data\": [\n",
" {\n",
" \"type\": \"findings\",\n",
" \"id\": \"019a0753-1e4b-7229-bb7d-91eab8fc0f4f\",\n",
" \"id\": \"019a0af5-e65a-7735-8223-e9aa5ab4c58e\",\n",
" \"attributes\": {\n",
" \"uid\": \"prowler-m365-teams_unmanaged_communication_disabled-f4dffefa-083f-4e9e-91e0-5d1e04f4b72b-global-Teams User Settings\",\n",
" \"uid\": \"prowler-aws-ssm_document_secrets-552455647653-us-east-1-SSM-SessionManagerRunShell\",\n",
" \"delta\": \"new\",\n",
" \"status\": \"PASS\",\n",
" \"status_extended\": \"Teams users cannot communicate with unmanaged users.\",\n",
" \"status_extended\": \"No secrets found in SSM Document SSM-SessionManagerRunShell.\",\n",
" \"severity\": \"critical\",\n",
" \"check_id\": \"teams_unmanaged_communication_disabled\",\n",
" \"check_id\": \"ssm_document_secrets\",\n",
" \"check_metadata\": {\n",
" \"risk\": \"Allowing communication with unmanaged Microsoft Teams users increases the risk of targeted attacks such as phishing, malware distribution (e.g., DarkGate), and exploitation techniques like GIFShell and username enumeration. Unmanaged accounts are easier for threat actors to create and use as attack vectors.\",\n",
" \"risk\": \"Secrets hardcoded into SSM Documents by malware and bad actors to gain lateral access to other services.\",\n",
" \"notes\": \"\",\n",
" \"checkid\": \"teams_unmanaged_communication_disabled\",\n",
" \"provider\": \"m365\",\n",
" \"checkid\": \"ssm_document_secrets\",\n",
" \"provider\": \"aws\",\n",
" \"severity\": \"critical\",\n",
" \"checktype\": [],\n",
" \"dependson\": [],\n",
" \"relatedto\": [],\n",
" \"categories\": [\n",
" \"e3\"\n",
" \"secrets\"\n",
" ],\n",
" \"checktitle\": \"Ensure unmanaged communication is disabled.\",\n",
" \"checktitle\": \"Find secrets in SSM Documents.\",\n",
" \"compliance\": [],\n",
" \"relatedurl\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n",
" \"description\": \"Ensure unmanaged communication is disabled in Teams admin center.\",\n",
" \"relatedurl\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n",
" \"description\": \"Find secrets in SSM Documents.\",\n",
" \"remediation\": {\n",
" \"code\": {\n",
" \"cli\": \"Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false\",\n",
" \"other\": \"1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Click to expand Users select External access. 3. Scroll to Teams accounts not managed by an organization. 4. Set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to Off. 5. Click Save.\",\n",
" \"cli\": \"\",\n",
" \"other\": \"\",\n",
" \"nativeiac\": \"\",\n",
" \"terraform\": \"\"\n",
" },\n",
" \"recommendation\": {\n",
" \"url\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n",
" \"text\": \"Disable communication with Teams users whose accounts aren't managed by an organization by setting 'People in my organization can communicate with Teams users whose accounts aren't managed by an organization' to Off. This helps prevent unauthorized or risky external interactions.\"\n",
" \"url\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n",
" \"text\": \"Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use Secrets Manager service to store and retrieve passwords and secrets.\"\n",
" }\n",
" },\n",
" \"servicename\": \"teams\",\n",
" \"servicename\": \"ssm\",\n",
" \"checkaliases\": [],\n",
" \"resourcetype\": \"Teams Settings\",\n",
" \"resourcetype\": \"AwsSsmDocument\",\n",
" \"additionalurls\": [],\n",
" \"subservicename\": \"\",\n",
" \"resourceidtemplate\": \"\"\n",
" \"resourceidtemplate\": \"arn:aws:ssm:region:account-id:document/document-name\"\n",
" },\n",
" \"raw_result\": {},\n",
" \"inserted_at\": \"2025-10-21T15:11:19.115828Z\",\n",
" \"updated_at\": \"2025-10-21T15:11:19.120405Z\",\n",
" \"first_seen_at\": \"2025-10-21T15:11:19.113770Z\",\n",
" \"inserted_at\": \"2025-10-22T08:07:58.811165Z\",\n",
" \"updated_at\": \"2025-10-22T08:07:58.818764Z\",\n",
" \"first_seen_at\": \"2025-10-22T08:07:58.808707Z\",\n",
" \"muted\": false,\n",
" \"muted_reason\": null\n",
" },\n",
@@ -496,7 +247,7 @@
" \"scan\": {\n",
" \"data\": {\n",
" \"type\": \"scans\",\n",
" \"id\": \"019a074f-e8c1-74b9-84e6-95a821f7ac30\"\n",
" \"id\": \"019a0aec-edbc-7815-8476-b4efb7a4059a\"\n",
" }\n",
" },\n",
" \"resources\": {\n",
@@ -506,21 +257,21 @@
" \"data\": [\n",
" {\n",
" \"type\": \"resources\",\n",
" \"id\": \"3455f95f-f985-48c4-ac34-d22baac19aa3\"\n",
" \"id\": \"f1f89f3d-22f8-43f6-a912-4edb23a7522a\"\n",
" }\n",
" ]\n",
" }\n",
" },\n",
" \"links\": {\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0753-1e4b-7229-bb7d-91eab8fc0f4f\"\n",
" \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0af5-e65a-7735-8223-e9aa5ab4c58e\"\n",
" }\n",
" }\n",
" ],\n",
" \"meta\": {\n",
" \"pagination\": {\n",
" \"page\": 1,\n",
" \"pages\": 946,\n",
" \"count\": 946\n",
" \"pages\": 138,\n",
" \"count\": 138\n",
" },\n",
" \"version\": \"v1\"\n",
" }\n",