From 481a2defc931c5f9403246f552d00c458d2e37b7 Mon Sep 17 00:00:00 2001 From: "Andoni A." <14891798+andoniaf@users.noreply.github.com> Date: Wed, 22 Oct 2025 15:21:53 +0200 Subject: [PATCH] poc: examples API token notebooks in DEV --- examples/api/api-key-bash.ipynb | 347 +++++--------------------------- examples/api/api-key.ipynb | 345 +++++-------------------------- 2 files changed, 98 insertions(+), 594 deletions(-) diff --git a/examples/api/api-key-bash.ipynb b/examples/api/api-key-bash.ipynb index 44e2b3811a..b414f0a324 100644 --- a/examples/api/api-key-bash.ipynb +++ b/examples/api/api-key-bash.ipynb @@ -34,7 +34,7 @@ }, { "cell_type": "code", - "execution_count": 5, + "execution_count": 1, "id": "cell-3", "metadata": {}, "outputs": [ @@ -70,7 +70,7 @@ }, { "cell_type": "code", - "execution_count": 6, + "execution_count": 2, "id": "cell-6", "metadata": {}, "outputs": [ @@ -80,7 +80,7 @@ "text": [ " % Total % Received % Xferd Average Speed Time Time Time Current\n", " Dload Upload Total Spent Left Speed\n", - "100 5647 100 5647 0 0 1467 0 0:00:03 0:00:03 --:--:-- 1467\n" + "100 1398 100 1398 0 0 2723 0 --:--:-- --:--:-- --:--:-- 2719\n" ] }, { @@ -90,155 +90,30 @@ "{\n", " \"links\": {\n", " \"first\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n", - " \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n", - " \"next\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n", + " \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n", + " \"next\": null,\n", " \"prev\": null\n", " },\n", " \"data\": [\n", " {\n", " \"type\": \"providers\",\n", - " \"id\": \"50af9045-023a-4390-b2a6-7e08bb482c7e\",\n", + " \"id\": \"46a9435b-a2f6-44ee-b267-710f8a403ace\",\n", " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-21T14:13:18.925063Z\",\n", - " \"updated_at\": \"2025-10-21T15:09:54.262401Z\",\n", - " \"provider\": \"m365\",\n", - " \"uid\": \"prowler.com\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": true,\n", - " \"last_checked_at\": \"2025-10-21T15:09:54.257607Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"d7308e68-ab2e-4c22-b388-e5005a5fc57d\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/50af9045-023a-4390-b2a6-7e08bb482c7e\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"e3bf0cb7-791f-42fd-9d19-b6d7db72290a\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-13T09:56:07.101323Z\",\n", - " \"updated_at\": \"2025-10-13T10:43:55.963669Z\",\n", - " \"provider\": \"gcp\",\n", - " \"uid\": \"empty-project-465413\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": true,\n", - " \"last_checked_at\": \"2025-10-13T10:43:55.959115Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"52f16eeb-14d6-46b8-9c97-a283e5386ac2\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/e3bf0cb7-791f-42fd-9d19-b6d7db72290a\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"53237f83-5c4d-45e4-82f3-aa9da4bbbe00\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-07T13:57:15.884120Z\",\n", - " \"updated_at\": \"2025-10-07T13:57:15.884136Z\",\n", - " \"provider\": \"gcp\",\n", - " \"uid\": \"test-posthog\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/53237f83-5c4d-45e4-82f3-aa9da4bbbe00\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"8c776ad5-d2ff-4574-bd41-753dbbd35bec\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-01T14:18:04.872628Z\",\n", - " \"updated_at\": \"2025-10-01T14:18:04.872644Z\",\n", + " \"inserted_at\": \"2025-10-22T07:46:12.089159Z\",\n", + " \"updated_at\": \"2025-10-22T08:00:04.923849Z\",\n", " \"provider\": \"aws\",\n", - " \"uid\": \"123456789122\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"b56191d1-328e-42ee-a0f3-1422bf3dca9f\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/8c776ad5-d2ff-4574-bd41-753dbbd35bec\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"09f9949d-e801-4865-803d-51c8ee9c70f5\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-28T06:57:15.819206Z\",\n", - " \"updated_at\": \"2025-09-25T14:33:14.763507Z\",\n", - " \"provider\": \"github\",\n", - " \"uid\": \"dTroop3r\",\n", - " \"alias\": \"GH using App\",\n", + " \"uid\": \"552455647653\",\n", + " \"alias\": \"Prowler Demo\",\n", " \"connection\": {\n", " \"connected\": true,\n", - " \"last_checked_at\": \"2025-09-25T14:33:14.757995Z\"\n", + " \"last_checked_at\": \"2025-10-22T08:00:04.918455Z\"\n", " }\n", " },\n", " \"relationships\": {\n", " \"secret\": {\n", " \"data\": {\n", " \"type\": \"provider-secrets\",\n", - " \"id\": \"6ade14ed-0113-4b42-955c-c0159315821a\"\n", + " \"id\": \"49fafccd-348f-47c1-9147-3494903290ff\"\n", " }\n", " },\n", " \"provider_groups\": {\n", @@ -249,28 +124,28 @@ " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/09f9949d-e801-4865-803d-51c8ee9c70f5\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/providers/46a9435b-a2f6-44ee-b267-710f8a403ace\"\n", " }\n", " },\n", " {\n", " \"type\": \"providers\",\n", - " \"id\": \"d664cb20-3cc8-403d-9d62-0773c61642d7\",\n", + " \"id\": \"9e499bb1-03fd-4588-b58a-75ef71334040\",\n", " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-28T06:48:40.344590Z\",\n", - " \"updated_at\": \"2025-08-28T09:53:07.955423Z\",\n", + " \"inserted_at\": \"2025-10-22T07:42:53.856378Z\",\n", + " \"updated_at\": \"2025-10-22T07:46:15.197305Z\",\n", " \"provider\": \"github\",\n", " \"uid\": \"PieceOfM1nd\",\n", " \"alias\": \"PieceOfM1nd (org)\",\n", " \"connection\": {\n", " \"connected\": true,\n", - " \"last_checked_at\": \"2025-08-28T09:53:07.949871Z\"\n", + " \"last_checked_at\": \"2025-10-22T07:46:15.191930Z\"\n", " }\n", " },\n", " \"relationships\": {\n", " \"secret\": {\n", " \"data\": {\n", " \"type\": \"provider-secrets\",\n", - " \"id\": \"ca7d8494-069b-4388-9d02-3310b96c6fbd\"\n", + " \"id\": \"3aa2c451-34e3-48c4-a0d6-db532181c892\"\n", " }\n", " },\n", " \"provider_groups\": {\n", @@ -281,137 +156,15 @@ " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/d664cb20-3cc8-403d-9d62-0773c61642d7\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"00acd090-ad97-4182-91d2-f279502fb3eb\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-21T16:35:31.030729Z\",\n", - " \"updated_at\": \"2025-08-21T17:14:25.890660Z\",\n", - " \"provider\": \"aws\",\n", - " \"uid\": \"123456789111\",\n", - " \"alias\": \"Test role bug\",\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"332bea53-6381-484d-83ed-ca1ccc52dd76\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/00acd090-ad97-4182-91d2-f279502fb3eb\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"dcf3bc9c-102c-4f47-9753-3732a70601d7\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-21T16:21:18.013721Z\",\n", - " \"updated_at\": \"2025-08-21T16:21:18.013738Z\",\n", - " \"provider\": \"aws\",\n", - " \"uid\": \"123456789012\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/dcf3bc9c-102c-4f47-9753-3732a70601d7\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"2642ea99-cd32-463c-a7e9-8b7791f8f7e5\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-09T07:54:03.128579Z\",\n", - " \"updated_at\": \"2025-08-09T07:54:03.128594Z\",\n", - " \"provider\": \"github\",\n", - " \"uid\": \"pedrooot\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/2642ea99-cd32-463c-a7e9-8b7791f8f7e5\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"bc7a6295-f706-4361-855d-2352829b6668\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-04T12:36:34.699122Z\",\n", - " \"updated_at\": \"2025-10-21T12:38:42.660182Z\",\n", - " \"provider\": \"kubernetes\",\n", - " \"uid\": \"arn:aws:eks:eu-west-1:106908755756:cluster/test\",\n", - " \"alias\": \"EKS Dev\",\n", - " \"connection\": {\n", - " \"connected\": false,\n", - " \"last_checked_at\": \"2025-10-21T12:38:42.655786Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"52471ba2-27de-4570-a762-aee33bc3f44c\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/bc7a6295-f706-4361-855d-2352829b6668\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/providers/9e499bb1-03fd-4588-b58a-75ef71334040\"\n", " }\n", " }\n", " ],\n", " \"meta\": {\n", " \"pagination\": {\n", " \"page\": 1,\n", - " \"pages\": 2,\n", - " \"count\": 16\n", + " \"pages\": 1,\n", + " \"count\": 2\n", " },\n", " \"version\": \"v1\"\n", " }\n", @@ -439,7 +192,7 @@ }, { "cell_type": "code", - "execution_count": 7, + "execution_count": 3, "id": "xkmbmm7rywb", "metadata": {}, "outputs": [ @@ -449,7 +202,7 @@ "text": [ " % Total % Received % Xferd Average Speed Time Time Time Current\n", " Dload Upload Total Spent Left Speed\n", - "100 3170 100 3170 0 0 2041 0 0:00:01 0:00:01 --:--:-- 2041\n" + "100 2465 100 2465 0 0 4558 0 --:--:-- --:--:-- --:--:-- 4556\n" ] }, { @@ -459,60 +212,60 @@ "{\n", " \"links\": {\n", " \"first\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=1&page%5Bsize%5D=1\",\n", - " \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=946&page%5Bsize%5D=1\",\n", + " \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=138&page%5Bsize%5D=1\",\n", " \"next\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=2&page%5Bsize%5D=1\",\n", " \"prev\": null\n", " },\n", " \"data\": [\n", " {\n", " \"type\": \"findings\",\n", - " \"id\": \"019a0753-1e4b-7229-bb7d-91eab8fc0f4f\",\n", + " \"id\": \"019a0af5-e65a-7735-8223-e9aa5ab4c58e\",\n", " \"attributes\": {\n", - " \"uid\": \"prowler-m365-teams_unmanaged_communication_disabled-f4dffefa-083f-4e9e-91e0-5d1e04f4b72b-global-Teams User Settings\",\n", + " \"uid\": \"prowler-aws-ssm_document_secrets-552455647653-us-east-1-SSM-SessionManagerRunShell\",\n", " \"delta\": \"new\",\n", " \"status\": \"PASS\",\n", - " \"status_extended\": \"Teams users cannot communicate with unmanaged users.\",\n", + " \"status_extended\": \"No secrets found in SSM Document SSM-SessionManagerRunShell.\",\n", " \"severity\": \"critical\",\n", - " \"check_id\": \"teams_unmanaged_communication_disabled\",\n", + " \"check_id\": \"ssm_document_secrets\",\n", " \"check_metadata\": {\n", - " \"risk\": \"Allowing communication with unmanaged Microsoft Teams users increases the risk of targeted attacks such as phishing, malware distribution (e.g., DarkGate), and exploitation techniques like GIFShell and username enumeration. Unmanaged accounts are easier for threat actors to create and use as attack vectors.\",\n", + " \"risk\": \"Secrets hardcoded into SSM Documents by malware and bad actors to gain lateral access to other services.\",\n", " \"notes\": \"\",\n", - " \"checkid\": \"teams_unmanaged_communication_disabled\",\n", - " \"provider\": \"m365\",\n", + " \"checkid\": \"ssm_document_secrets\",\n", + " \"provider\": \"aws\",\n", " \"severity\": \"critical\",\n", " \"checktype\": [],\n", " \"dependson\": [],\n", " \"relatedto\": [],\n", " \"categories\": [\n", - " \"e3\"\n", + " \"secrets\"\n", " ],\n", - " \"checktitle\": \"Ensure unmanaged communication is disabled.\",\n", + " \"checktitle\": \"Find secrets in SSM Documents.\",\n", " \"compliance\": [],\n", - " \"relatedurl\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n", - " \"description\": \"Ensure unmanaged communication is disabled in Teams admin center.\",\n", + " \"relatedurl\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n", + " \"description\": \"Find secrets in SSM Documents.\",\n", " \"remediation\": {\n", " \"code\": {\n", - " \"cli\": \"Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false\",\n", - " \"other\": \"1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Click to expand Users select External access. 3. Scroll to Teams accounts not managed by an organization. 4. Set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to Off. 5. Click Save.\",\n", + " \"cli\": \"\",\n", + " \"other\": \"\",\n", " \"nativeiac\": \"\",\n", " \"terraform\": \"\"\n", " },\n", " \"recommendation\": {\n", - " \"url\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n", - " \"text\": \"Disable communication with Teams users whose accounts aren't managed by an organization by setting 'People in my organization can communicate with Teams users whose accounts aren't managed by an organization' to Off. This helps prevent unauthorized or risky external interactions.\"\n", + " \"url\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n", + " \"text\": \"Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use Secrets Manager service to store and retrieve passwords and secrets.\"\n", " }\n", " },\n", - " \"servicename\": \"teams\",\n", + " \"servicename\": \"ssm\",\n", " \"checkaliases\": [],\n", - " \"resourcetype\": \"Teams Settings\",\n", + " \"resourcetype\": \"AwsSsmDocument\",\n", " \"additionalurls\": [],\n", " \"subservicename\": \"\",\n", - " \"resourceidtemplate\": \"\"\n", + " \"resourceidtemplate\": \"arn:aws:ssm:region:account-id:document/document-name\"\n", " },\n", " \"raw_result\": {},\n", - " \"inserted_at\": \"2025-10-21T15:11:19.115828Z\",\n", - " \"updated_at\": \"2025-10-21T15:11:19.120405Z\",\n", - " \"first_seen_at\": \"2025-10-21T15:11:19.113770Z\",\n", + " \"inserted_at\": \"2025-10-22T08:07:58.811165Z\",\n", + " \"updated_at\": \"2025-10-22T08:07:58.818764Z\",\n", + " \"first_seen_at\": \"2025-10-22T08:07:58.808707Z\",\n", " \"muted\": false,\n", " \"muted_reason\": null\n", " },\n", @@ -520,7 +273,7 @@ " \"scan\": {\n", " \"data\": {\n", " \"type\": \"scans\",\n", - " \"id\": \"019a074f-e8c1-74b9-84e6-95a821f7ac30\"\n", + " \"id\": \"019a0aec-edbc-7815-8476-b4efb7a4059a\"\n", " }\n", " },\n", " \"resources\": {\n", @@ -530,21 +283,21 @@ " \"data\": [\n", " {\n", " \"type\": \"resources\",\n", - " \"id\": \"3455f95f-f985-48c4-ac34-d22baac19aa3\"\n", + " \"id\": \"f1f89f3d-22f8-43f6-a912-4edb23a7522a\"\n", " }\n", " ]\n", " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0753-1e4b-7229-bb7d-91eab8fc0f4f\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0af5-e65a-7735-8223-e9aa5ab4c58e\"\n", " }\n", " }\n", " ],\n", " \"meta\": {\n", " \"pagination\": {\n", " \"page\": 1,\n", - " \"pages\": 946,\n", - " \"count\": 946\n", + " \"pages\": 138,\n", + " \"count\": 138\n", " },\n", " \"version\": \"v1\"\n", " }\n", diff --git a/examples/api/api-key.ipynb b/examples/api/api-key.ipynb index f6416957e5..544af7fac4 100644 --- a/examples/api/api-key.ipynb +++ b/examples/api/api-key.ipynb @@ -31,7 +31,7 @@ }, { "cell_type": "code", - "execution_count": 8, + "execution_count": 1, "metadata": {}, "outputs": [], "source": [ @@ -56,7 +56,7 @@ }, { "cell_type": "code", - "execution_count": 9, + "execution_count": 2, "metadata": {}, "outputs": [ { @@ -66,155 +66,30 @@ "{\n", " \"links\": {\n", " \"first\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n", - " \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n", - " \"next\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=2\",\n", + " \"last\": \"https://api.dev.prowler.com/api/v1/providers?page%5Bnumber%5D=1\",\n", + " \"next\": null,\n", " \"prev\": null\n", " },\n", " \"data\": [\n", " {\n", " \"type\": \"providers\",\n", - " \"id\": \"50af9045-023a-4390-b2a6-7e08bb482c7e\",\n", + " \"id\": \"46a9435b-a2f6-44ee-b267-710f8a403ace\",\n", " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-21T14:13:18.925063Z\",\n", - " \"updated_at\": \"2025-10-21T15:09:54.262401Z\",\n", - " \"provider\": \"m365\",\n", - " \"uid\": \"prowler.com\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": true,\n", - " \"last_checked_at\": \"2025-10-21T15:09:54.257607Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"d7308e68-ab2e-4c22-b388-e5005a5fc57d\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/50af9045-023a-4390-b2a6-7e08bb482c7e\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"e3bf0cb7-791f-42fd-9d19-b6d7db72290a\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-13T09:56:07.101323Z\",\n", - " \"updated_at\": \"2025-10-13T10:43:55.963669Z\",\n", - " \"provider\": \"gcp\",\n", - " \"uid\": \"empty-project-465413\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": true,\n", - " \"last_checked_at\": \"2025-10-13T10:43:55.959115Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"52f16eeb-14d6-46b8-9c97-a283e5386ac2\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/e3bf0cb7-791f-42fd-9d19-b6d7db72290a\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"53237f83-5c4d-45e4-82f3-aa9da4bbbe00\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-07T13:57:15.884120Z\",\n", - " \"updated_at\": \"2025-10-07T13:57:15.884136Z\",\n", - " \"provider\": \"gcp\",\n", - " \"uid\": \"test-posthog\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/53237f83-5c4d-45e4-82f3-aa9da4bbbe00\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"8c776ad5-d2ff-4574-bd41-753dbbd35bec\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-10-01T14:18:04.872628Z\",\n", - " \"updated_at\": \"2025-10-01T14:18:04.872644Z\",\n", + " \"inserted_at\": \"2025-10-22T07:46:12.089159Z\",\n", + " \"updated_at\": \"2025-10-22T08:00:04.923849Z\",\n", " \"provider\": \"aws\",\n", - " \"uid\": \"123456789122\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"b56191d1-328e-42ee-a0f3-1422bf3dca9f\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/8c776ad5-d2ff-4574-bd41-753dbbd35bec\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"09f9949d-e801-4865-803d-51c8ee9c70f5\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-28T06:57:15.819206Z\",\n", - " \"updated_at\": \"2025-09-25T14:33:14.763507Z\",\n", - " \"provider\": \"github\",\n", - " \"uid\": \"dTroop3r\",\n", - " \"alias\": \"GH using App\",\n", + " \"uid\": \"552455647653\",\n", + " \"alias\": \"Prowler Demo\",\n", " \"connection\": {\n", " \"connected\": true,\n", - " \"last_checked_at\": \"2025-09-25T14:33:14.757995Z\"\n", + " \"last_checked_at\": \"2025-10-22T08:00:04.918455Z\"\n", " }\n", " },\n", " \"relationships\": {\n", " \"secret\": {\n", " \"data\": {\n", " \"type\": \"provider-secrets\",\n", - " \"id\": \"6ade14ed-0113-4b42-955c-c0159315821a\"\n", + " \"id\": \"49fafccd-348f-47c1-9147-3494903290ff\"\n", " }\n", " },\n", " \"provider_groups\": {\n", @@ -225,28 +100,28 @@ " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/09f9949d-e801-4865-803d-51c8ee9c70f5\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/providers/46a9435b-a2f6-44ee-b267-710f8a403ace\"\n", " }\n", " },\n", " {\n", " \"type\": \"providers\",\n", - " \"id\": \"d664cb20-3cc8-403d-9d62-0773c61642d7\",\n", + " \"id\": \"9e499bb1-03fd-4588-b58a-75ef71334040\",\n", " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-28T06:48:40.344590Z\",\n", - " \"updated_at\": \"2025-08-28T09:53:07.955423Z\",\n", + " \"inserted_at\": \"2025-10-22T07:42:53.856378Z\",\n", + " \"updated_at\": \"2025-10-22T07:46:15.197305Z\",\n", " \"provider\": \"github\",\n", " \"uid\": \"PieceOfM1nd\",\n", " \"alias\": \"PieceOfM1nd (org)\",\n", " \"connection\": {\n", " \"connected\": true,\n", - " \"last_checked_at\": \"2025-08-28T09:53:07.949871Z\"\n", + " \"last_checked_at\": \"2025-10-22T07:46:15.191930Z\"\n", " }\n", " },\n", " \"relationships\": {\n", " \"secret\": {\n", " \"data\": {\n", " \"type\": \"provider-secrets\",\n", - " \"id\": \"ca7d8494-069b-4388-9d02-3310b96c6fbd\"\n", + " \"id\": \"3aa2c451-34e3-48c4-a0d6-db532181c892\"\n", " }\n", " },\n", " \"provider_groups\": {\n", @@ -257,137 +132,15 @@ " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/d664cb20-3cc8-403d-9d62-0773c61642d7\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"00acd090-ad97-4182-91d2-f279502fb3eb\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-21T16:35:31.030729Z\",\n", - " \"updated_at\": \"2025-08-21T17:14:25.890660Z\",\n", - " \"provider\": \"aws\",\n", - " \"uid\": \"123456789111\",\n", - " \"alias\": \"Test role bug\",\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"332bea53-6381-484d-83ed-ca1ccc52dd76\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/00acd090-ad97-4182-91d2-f279502fb3eb\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"dcf3bc9c-102c-4f47-9753-3732a70601d7\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-21T16:21:18.013721Z\",\n", - " \"updated_at\": \"2025-08-21T16:21:18.013738Z\",\n", - " \"provider\": \"aws\",\n", - " \"uid\": \"123456789012\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/dcf3bc9c-102c-4f47-9753-3732a70601d7\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"2642ea99-cd32-463c-a7e9-8b7791f8f7e5\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-09T07:54:03.128579Z\",\n", - " \"updated_at\": \"2025-08-09T07:54:03.128594Z\",\n", - " \"provider\": \"github\",\n", - " \"uid\": \"pedrooot\",\n", - " \"alias\": null,\n", - " \"connection\": {\n", - " \"connected\": null,\n", - " \"last_checked_at\": null\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": null\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/2642ea99-cd32-463c-a7e9-8b7791f8f7e5\"\n", - " }\n", - " },\n", - " {\n", - " \"type\": \"providers\",\n", - " \"id\": \"bc7a6295-f706-4361-855d-2352829b6668\",\n", - " \"attributes\": {\n", - " \"inserted_at\": \"2025-08-04T12:36:34.699122Z\",\n", - " \"updated_at\": \"2025-10-21T12:38:42.660182Z\",\n", - " \"provider\": \"kubernetes\",\n", - " \"uid\": \"arn:aws:eks:eu-west-1:106908755756:cluster/test\",\n", - " \"alias\": \"EKS Dev\",\n", - " \"connection\": {\n", - " \"connected\": false,\n", - " \"last_checked_at\": \"2025-10-21T12:38:42.655786Z\"\n", - " }\n", - " },\n", - " \"relationships\": {\n", - " \"secret\": {\n", - " \"data\": {\n", - " \"type\": \"provider-secrets\",\n", - " \"id\": \"52471ba2-27de-4570-a762-aee33bc3f44c\"\n", - " }\n", - " },\n", - " \"provider_groups\": {\n", - " \"meta\": {\n", - " \"count\": 0\n", - " },\n", - " \"data\": []\n", - " }\n", - " },\n", - " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/providers/bc7a6295-f706-4361-855d-2352829b6668\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/providers/9e499bb1-03fd-4588-b58a-75ef71334040\"\n", " }\n", " }\n", " ],\n", " \"meta\": {\n", " \"pagination\": {\n", " \"page\": 1,\n", - " \"pages\": 2,\n", - " \"count\": 16\n", + " \"pages\": 1,\n", + " \"count\": 2\n", " },\n", " \"version\": \"v1\"\n", " }\n", @@ -400,8 +153,6 @@ "import os\n", "import json\n", "\n", - "prowler_api_key = os.environ.get('PROWLER_API_KEY')\n", - "\n", "headers = {\n", " 'Authorization': f'Api-Key {prowler_api_key}',\n", " 'Content-Type': 'application/vnd.api+json'\n", @@ -425,7 +176,7 @@ }, { "cell_type": "code", - "execution_count": 10, + "execution_count": 3, "metadata": {}, "outputs": [ { @@ -435,60 +186,60 @@ "{\n", " \"links\": {\n", " \"first\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=1&page%5Bsize%5D=1\",\n", - " \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=946&page%5Bsize%5D=1\",\n", + " \"last\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=138&page%5Bsize%5D=1\",\n", " \"next\": \"https://api.dev.prowler.com/api/v1/findings/latest?filter%5Bseverity__in%5D=critical&page%5Bnumber%5D=2&page%5Bsize%5D=1\",\n", " \"prev\": null\n", " },\n", " \"data\": [\n", " {\n", " \"type\": \"findings\",\n", - " \"id\": \"019a0753-1e4b-7229-bb7d-91eab8fc0f4f\",\n", + " \"id\": \"019a0af5-e65a-7735-8223-e9aa5ab4c58e\",\n", " \"attributes\": {\n", - " \"uid\": \"prowler-m365-teams_unmanaged_communication_disabled-f4dffefa-083f-4e9e-91e0-5d1e04f4b72b-global-Teams User Settings\",\n", + " \"uid\": \"prowler-aws-ssm_document_secrets-552455647653-us-east-1-SSM-SessionManagerRunShell\",\n", " \"delta\": \"new\",\n", " \"status\": \"PASS\",\n", - " \"status_extended\": \"Teams users cannot communicate with unmanaged users.\",\n", + " \"status_extended\": \"No secrets found in SSM Document SSM-SessionManagerRunShell.\",\n", " \"severity\": \"critical\",\n", - " \"check_id\": \"teams_unmanaged_communication_disabled\",\n", + " \"check_id\": \"ssm_document_secrets\",\n", " \"check_metadata\": {\n", - " \"risk\": \"Allowing communication with unmanaged Microsoft Teams users increases the risk of targeted attacks such as phishing, malware distribution (e.g., DarkGate), and exploitation techniques like GIFShell and username enumeration. Unmanaged accounts are easier for threat actors to create and use as attack vectors.\",\n", + " \"risk\": \"Secrets hardcoded into SSM Documents by malware and bad actors to gain lateral access to other services.\",\n", " \"notes\": \"\",\n", - " \"checkid\": \"teams_unmanaged_communication_disabled\",\n", - " \"provider\": \"m365\",\n", + " \"checkid\": \"ssm_document_secrets\",\n", + " \"provider\": \"aws\",\n", " \"severity\": \"critical\",\n", " \"checktype\": [],\n", " \"dependson\": [],\n", " \"relatedto\": [],\n", " \"categories\": [\n", - " \"e3\"\n", + " \"secrets\"\n", " ],\n", - " \"checktitle\": \"Ensure unmanaged communication is disabled.\",\n", + " \"checktitle\": \"Find secrets in SSM Documents.\",\n", " \"compliance\": [],\n", - " \"relatedurl\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n", - " \"description\": \"Ensure unmanaged communication is disabled in Teams admin center.\",\n", + " \"relatedurl\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n", + " \"description\": \"Find secrets in SSM Documents.\",\n", " \"remediation\": {\n", " \"code\": {\n", - " \"cli\": \"Set-CsTenantFederationConfiguration -AllowTeamsConsumer $false\",\n", - " \"other\": \"1. Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com/. 2. Click to expand Users select External access. 3. Scroll to Teams accounts not managed by an organization. 4. Set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to Off. 5. Click Save.\",\n", + " \"cli\": \"\",\n", + " \"other\": \"\",\n", " \"nativeiac\": \"\",\n", " \"terraform\": \"\"\n", " },\n", " \"recommendation\": {\n", - " \"url\": \"https://learn.microsoft.com/en-us/powershell/module/teams/set-cstenantfederationconfiguration?view=teams-ps\",\n", - " \"text\": \"Disable communication with Teams users whose accounts aren't managed by an organization by setting 'People in my organization can communicate with Teams users whose accounts aren't managed by an organization' to Off. This helps prevent unauthorized or risky external interactions.\"\n", + " \"url\": \"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-secretsmanager-secret-generatesecretstring.html\",\n", + " \"text\": \"Implement automated detective control (e.g. using tools like Prowler) to scan accounts for passwords and secrets. Use Secrets Manager service to store and retrieve passwords and secrets.\"\n", " }\n", " },\n", - " \"servicename\": \"teams\",\n", + " \"servicename\": \"ssm\",\n", " \"checkaliases\": [],\n", - " \"resourcetype\": \"Teams Settings\",\n", + " \"resourcetype\": \"AwsSsmDocument\",\n", " \"additionalurls\": [],\n", " \"subservicename\": \"\",\n", - " \"resourceidtemplate\": \"\"\n", + " \"resourceidtemplate\": \"arn:aws:ssm:region:account-id:document/document-name\"\n", " },\n", " \"raw_result\": {},\n", - " \"inserted_at\": \"2025-10-21T15:11:19.115828Z\",\n", - " \"updated_at\": \"2025-10-21T15:11:19.120405Z\",\n", - " \"first_seen_at\": \"2025-10-21T15:11:19.113770Z\",\n", + " \"inserted_at\": \"2025-10-22T08:07:58.811165Z\",\n", + " \"updated_at\": \"2025-10-22T08:07:58.818764Z\",\n", + " \"first_seen_at\": \"2025-10-22T08:07:58.808707Z\",\n", " \"muted\": false,\n", " \"muted_reason\": null\n", " },\n", @@ -496,7 +247,7 @@ " \"scan\": {\n", " \"data\": {\n", " \"type\": \"scans\",\n", - " \"id\": \"019a074f-e8c1-74b9-84e6-95a821f7ac30\"\n", + " \"id\": \"019a0aec-edbc-7815-8476-b4efb7a4059a\"\n", " }\n", " },\n", " \"resources\": {\n", @@ -506,21 +257,21 @@ " \"data\": [\n", " {\n", " \"type\": \"resources\",\n", - " \"id\": \"3455f95f-f985-48c4-ac34-d22baac19aa3\"\n", + " \"id\": \"f1f89f3d-22f8-43f6-a912-4edb23a7522a\"\n", " }\n", " ]\n", " }\n", " },\n", " \"links\": {\n", - " \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0753-1e4b-7229-bb7d-91eab8fc0f4f\"\n", + " \"self\": \"https://api.dev.prowler.com/api/v1/findings/019a0af5-e65a-7735-8223-e9aa5ab4c58e\"\n", " }\n", " }\n", " ],\n", " \"meta\": {\n", " \"pagination\": {\n", " \"page\": 1,\n", - " \"pages\": 946,\n", - " \"count\": 946\n", + " \"pages\": 138,\n", + " \"count\": 138\n", " },\n", " \"version\": \"v1\"\n", " }\n",