From 2222082631eee7857f69a4eb0c25311aa18f93c8 Mon Sep 17 00:00:00 2001 From: lydiavilchez <114735608+lydiavilchez@users.noreply.github.com> Date: Mon, 1 Jun 2026 10:52:32 +0200 Subject: [PATCH 01/12] fix(googleworkspace): update metadata urls to point to official documentation (#11405) --- prowler/CHANGELOG.md | 1 + ...additionalservices_external_groups_disabled.metadata.json | 4 ++-- .../calendar_external_invitations_warning.metadata.json | 5 ++--- .../calendar_external_sharing_primary_calendar.metadata.json | 3 +-- ...alendar_external_sharing_secondary_calendar.metadata.json | 3 +-- .../chat_apps_installation_disabled.metadata.json | 4 ++-- .../chat_external_file_sharing_disabled.metadata.json | 4 ++-- .../chat_external_messaging_restricted.metadata.json | 4 ++-- .../chat_external_spaces_restricted.metadata.json | 4 ++-- .../chat_incoming_webhooks_disabled.metadata.json | 4 ++-- .../chat_internal_file_sharing_disabled.metadata.json | 4 ++-- .../directory_super_admin_count.metadata.json | 2 +- .../directory_super_admin_only_admin_roles.metadata.json | 2 +- .../drive_access_checker_recipients_only.metadata.json | 4 ++-- .../drive_desktop_access_disabled.metadata.json | 4 ++-- .../drive_external_sharing_warn_users.metadata.json | 4 ++-- .../drive_internal_users_distribute_content.metadata.json | 4 ++-- .../drive_publishing_files_disabled.metadata.json | 4 ++-- .../drive_shared_drive_creation_allowed.metadata.json | 4 ++-- ...ve_shared_drive_disable_download_print_copy.metadata.json | 4 ++-- ...drive_shared_drive_managers_cannot_override.metadata.json | 4 ++-- .../drive_shared_drive_members_only_access.metadata.json | 4 ++-- .../drive_sharing_allowlisted_domains.metadata.json | 4 ++-- ...drive_warn_sharing_with_allowlisted_domains.metadata.json | 4 ++-- ...ail_anomalous_attachment_protection_enabled.metadata.json | 4 ++-- .../gmail_auto_forwarding_disabled.metadata.json | 4 ++-- .../gmail_comprehensive_mail_storage_enabled.metadata.json | 4 ++-- .../gmail_domain_spoofing_protection_enabled.metadata.json | 4 ++-- ...l_employee_name_spoofing_protection_enabled.metadata.json | 4 ++-- ...ail_encrypted_attachment_protection_enabled.metadata.json | 4 ++-- ...mail_enhanced_pre_delivery_scanning_enabled.metadata.json | 4 ++-- .../gmail_external_image_scanning_enabled.metadata.json | 4 ++-- .../gmail_groups_spoofing_protection_enabled.metadata.json | 4 ++-- ..._inbound_domain_spoofing_protection_enabled.metadata.json | 4 ++-- .../gmail_mail_delegation_disabled.metadata.json | 4 ++-- .../gmail_per_user_outbound_gateway_disabled.metadata.json | 4 ++-- .../gmail_pop_imap_access_disabled.metadata.json | 4 ++-- .../gmail_script_attachment_protection_enabled.metadata.json | 4 ++-- .../gmail_shortener_scanning_enabled.metadata.json | 4 ++-- ...il_unauthenticated_email_protection_enabled.metadata.json | 4 ++-- .../gmail_untrusted_link_warnings_enabled.metadata.json | 4 ++-- .../groups_creation_restricted.metadata.json | 4 ++-- .../groups_external_access_restricted.metadata.json | 4 ++-- .../groups_view_conversations_restricted.metadata.json | 4 ++-- .../marketplace_apps_access_restricted.metadata.json | 4 ++-- .../security_2sv_enforced.metadata.json | 2 +- .../security_2sv_hardware_keys_admins.metadata.json | 2 +- .../security_advanced_protection_configured.metadata.json | 2 +- .../security_app_access_restricted.metadata.json | 2 +- .../security_dlp_drive_rules_configured.metadata.json | 2 +- .../security_internal_apps_trusted.metadata.json | 2 +- .../security_less_secure_apps_disabled.metadata.json | 2 +- .../security_login_challenges_configured.metadata.json | 2 +- .../security_password_policy_strong.metadata.json | 2 +- .../security_session_duration_limited.metadata.json | 2 +- .../security_super_admin_recovery_disabled.metadata.json | 2 +- .../security_user_recovery_enabled.metadata.json | 2 +- .../sites_service_disabled.metadata.json | 4 ++-- 58 files changed, 99 insertions(+), 101 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index a997e09d31..ea1707c71b 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -19,6 +19,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### 🐞 Fixed +- Broken documentation URLs in Google Workspace check metadata [(#11405)](https://github.com/prowler-cloud/prowler/pull/11405) - ENS RD 311/2022 (AWS) compliance mapping: `vpc_different_regions` was uncorrectly mapped under the `mp.com.4` family (Network segregation). That check is now mapped to a new `op.cont.2.aws.vpc.1` requirement under the Continuity of Service control [(#11372)](https://github.com/prowler-cloud/prowler/pull/11372) - Compliance CSV row count now matches the UI per requirement by sourcing rows from the framework JSON's `requirement.Checks` instead of the stale `finding.compliance` snapshot [(#11370)](https://github.com/prowler-cloud/prowler/pull/11370) - OpenStack provider exception codes moved from the `10000-10999` range, shared with the AlibabaCloud provider, to the free `17000-17999` range to keep error codes unambiguous [(#11382)](https://github.com/prowler-cloud/prowler/pull/11382) diff --git a/prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.metadata.json b/prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.metadata.json index 82bb368a8a..8dcf6c1f3f 100644 --- a/prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/additionalservices/additionalservices_external_groups_disabled/additionalservices_external_groups_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "When external Google Groups access is enabled, users can access and participate in groups created **outside the organization**, potentially exposing them to **phishing, social engineering, or data leakage** through unmanaged external group communications.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/181865", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/users/advanced/turn-on-or-off-additional-google-services", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.metadata.json b/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.metadata.json index 4c7e71c102..3cca0005dd 100644 --- a/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.metadata.json +++ b/prowler/providers/googleworkspace/services/calendar/calendar_external_invitations_warning/calendar_external_invitations_warning.metadata.json @@ -13,9 +13,8 @@ "Risk": "Without external invitation warnings, users may unintentionally include **external guests** in internal meetings, exposing **confidential meeting details**, agendas, and internal attendee lists to unauthorized parties. This is a common vector for inadvertent data leakage through everyday calendar actions.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/6329284", - "https://knowledge.workspace.google.com/admin/calendar/set-google-calendar-sharing-options", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/calendar/allow-external-invitations-in-google-calendar-events", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.metadata.json b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.metadata.json index 87a82946e5..d923754a9e 100644 --- a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.metadata.json +++ b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_primary_calendar/calendar_external_sharing_primary_calendar.metadata.json @@ -13,9 +13,8 @@ "Risk": "Overly permissive external sharing of primary calendars exposes **sensitive meeting metadata** — titles, attendees, locations, and descriptions — to users outside the organization. This increases the risk of **information disclosure**, **social engineering**, and **targeted phishing** based on insights into organizational activities.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60765", "https://knowledge.workspace.google.com/admin/calendar/set-google-calendar-sharing-options", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_secondary_calendar/calendar_external_sharing_secondary_calendar.metadata.json b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_secondary_calendar/calendar_external_sharing_secondary_calendar.metadata.json index bd2bbf5be7..d1ac914a0f 100644 --- a/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_secondary_calendar/calendar_external_sharing_secondary_calendar.metadata.json +++ b/prowler/providers/googleworkspace/services/calendar/calendar_external_sharing_secondary_calendar/calendar_external_sharing_secondary_calendar.metadata.json @@ -13,9 +13,8 @@ "Risk": "Overly permissive external sharing of secondary calendars exposes **project-specific or team-specific event details** to users outside the organization. Because secondary calendars often hold more targeted activities (e.g., product launches, internal reviews), unrestricted external sharing increases the risk of **information disclosure** and **competitive intelligence leakage**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60765", "https://knowledge.workspace.google.com/admin/calendar/set-google-calendar-sharing-options", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_apps_installation_disabled/chat_apps_installation_disabled.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_apps_installation_disabled/chat_apps_installation_disabled.metadata.json index 54f4d6d852..070de032e1 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_apps_installation_disabled/chat_apps_installation_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_apps_installation_disabled/chat_apps_installation_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Unrestricted Chat app installation allows **unvetted third-party applications** to access user data including conversation content and organizational information. An attacker could distribute a malicious Chat app to **exfiltrate confidential data** or establish **persistent access** to internal communications.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/6089179", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/apps/manage-the-marketplace-app-allowlist-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_external_file_sharing_disabled/chat_external_file_sharing_disabled.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_external_file_sharing_disabled/chat_external_file_sharing_disabled.metadata.json index c2d8323994..adc1b1fc5f 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_external_file_sharing_disabled/chat_external_file_sharing_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_external_file_sharing_disabled/chat_external_file_sharing_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Enabled external file sharing allows users to send files containing **confidential information** to external parties through Chat. This creates a **data leakage** channel that bypasses DLP controls, particularly dangerous for organizations handling **regulated data** such as PII, PHI, or financial records.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9540647", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/chat/set-up-chat-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_external_messaging_restricted/chat_external_messaging_restricted.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_external_messaging_restricted/chat_external_messaging_restricted.metadata.json index 0c366d7689..34b0016065 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_external_messaging_restricted/chat_external_messaging_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_external_messaging_restricted/chat_external_messaging_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Unrestricted external messaging allows users to communicate freely with **any external party**, increasing the risk of **data exfiltration** through conversation content and **social engineering attacks** from untrusted domains targeting internal users.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9540647", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/chat/set-up-chat-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_external_spaces_restricted/chat_external_spaces_restricted.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_external_spaces_restricted/chat_external_spaces_restricted.metadata.json index 9f40730d9f..1385f34ef8 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_external_spaces_restricted/chat_external_spaces_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_external_spaces_restricted/chat_external_spaces_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Unrestricted external spaces allow users to add **anyone from any domain** to persistent group conversations. This increases the risk of **confidential information exposure** in shared spaces and enables **unauthorized external access** to ongoing organizational discussions.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9540647", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/chat/set-up-chat-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_incoming_webhooks_disabled/chat_incoming_webhooks_disabled.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_incoming_webhooks_disabled/chat_incoming_webhooks_disabled.metadata.json index 7dec1c83e4..8e8f4b6301 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_incoming_webhooks_disabled/chat_incoming_webhooks_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_incoming_webhooks_disabled/chat_incoming_webhooks_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Exposed webhook URLs allow **unauthorized content injection** into Chat spaces. Attackers can send **fraudulent or misleading messages** that appear to come from trusted services, creating a vector for **social engineering** and **phishing** within internal communications.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/6089179", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/apps/manage-the-marketplace-app-allowlist-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/chat/chat_internal_file_sharing_disabled/chat_internal_file_sharing_disabled.metadata.json b/prowler/providers/googleworkspace/services/chat/chat_internal_file_sharing_disabled/chat_internal_file_sharing_disabled.metadata.json index af2130d741..b41f662cc3 100644 --- a/prowler/providers/googleworkspace/services/chat/chat_internal_file_sharing_disabled/chat_internal_file_sharing_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/chat/chat_internal_file_sharing_disabled/chat_internal_file_sharing_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Unrestricted internal file sharing in Chat allows files with **sensitive information** to be distributed freely without passing through approved channels. This undermines **data governance** and **audit trail** requirements, making it harder to track data movement within the organization.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9540647", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/chat/set-up-chat-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/directory/directory_super_admin_count/directory_super_admin_count.metadata.json b/prowler/providers/googleworkspace/services/directory/directory_super_admin_count/directory_super_admin_count.metadata.json index 24165aaade..fcd769cd12 100644 --- a/prowler/providers/googleworkspace/services/directory/directory_super_admin_count/directory_super_admin_count.metadata.json +++ b/prowler/providers/googleworkspace/services/directory/directory_super_admin_count/directory_super_admin_count.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles", - "https://support.google.com/a/answer/9011373" + "https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/directory/directory_super_admin_only_admin_roles/directory_super_admin_only_admin_roles.metadata.json b/prowler/providers/googleworkspace/services/directory/directory_super_admin_only_admin_roles/directory_super_admin_only_admin_roles.metadata.json index 0264078982..ec531f10c8 100644 --- a/prowler/providers/googleworkspace/services/directory/directory_super_admin_only_admin_roles/directory_super_admin_only_admin_roles.metadata.json +++ b/prowler/providers/googleworkspace/services/directory/directory_super_admin_only_admin_roles/directory_super_admin_only_admin_roles.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles", - "https://support.google.com/a/answer/9011373" + "https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_access_checker_recipients_only/drive_access_checker_recipients_only.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_access_checker_recipients_only/drive_access_checker_recipients_only.metadata.json index a79283f9c3..8f1c14510a 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_access_checker_recipients_only/drive_access_checker_recipients_only.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_access_checker_recipients_only/drive_access_checker_recipients_only.metadata.json @@ -13,8 +13,8 @@ "Risk": "If Access Checker suggests broader audiences or public visibility, users may **inadvertently widen access** to a file beyond the people they intended to share with. This is a common cause of unintentional internal or external over-sharing.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_desktop_access_disabled/drive_desktop_access_disabled.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_desktop_access_disabled/drive_desktop_access_disabled.metadata.json index 43a08b0cab..576f78b19f 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_desktop_access_disabled/drive_desktop_access_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_desktop_access_disabled/drive_desktop_access_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "When Drive for desktop is enabled, organizational files are **synchronized to local devices** and remain accessible if the device is lost, stolen, or compromised. Because Drive for desktop bypasses the central offline-access controls, this channel is a frequently overlooked path for sensitive data to leave organization-managed environments.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7491144", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/set-up-drive-for-desktop-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.metadata.json index 8cfd0b4de8..474cadfe20 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_external_sharing_warn_users/drive_external_sharing_warn_users.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without external sharing warnings, users may unintentionally share **sensitive documents** with external recipients who are not entitled to the data. This is a common vector for inadvertent leakage of intellectual property, personally identifiable information, and confidential business data through routine Drive sharing.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_internal_users_distribute_content/drive_internal_users_distribute_content.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_internal_users_distribute_content/drive_internal_users_distribute_content.metadata.json index 9194d6d19e..df537051ba 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_internal_users_distribute_content/drive_internal_users_distribute_content.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_internal_users_distribute_content/drive_internal_users_distribute_content.metadata.json @@ -13,8 +13,8 @@ "Risk": "If external users can move files from internal shared drives into shared drives owned by another organization, the organization **loses authoritative control** over its own data. This is a frequently overlooked path for unintentional or malicious data exfiltration through shared drive collaboration.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json index 9968665841..323d7f07a1 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_publishing_files_disabled/drive_publishing_files_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowing users to publish Drive files to the web creates a path for **unbounded data exposure**. Sensitive documents, intellectual property, customer data, or internal communications can be made publicly accessible — and indexed by search engines — with a single click, often unintentionally.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.metadata.json index aba88e28b3..c27742b7ed 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_creation_allowed/drive_shared_drive_creation_allowed.metadata.json @@ -13,8 +13,8 @@ "Risk": "When users cannot create shared drives, they store collaborative content in their personal **My Drive** instead. When that user account is deleted, the data is also deleted, leading to **unintentional data loss** of organizationally significant information. Allowing shared drive creation makes data survivable across account lifecycle events.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7212025", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://support.google.com/a/users/answer/7212025", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.metadata.json index d4bf3300b7..b2a7738925 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_disable_download_print_copy/drive_shared_drive_disable_download_print_copy.metadata.json @@ -13,8 +13,8 @@ "Risk": "When viewers and commenters can download, print, or copy shared drive files, they can **bulk-extract sensitive content** — including intellectual property, personally identifiable information, and confidential business documents — using nothing more than read access. This is one of the most direct paths to data exfiltration through Drive.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7662202", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_managers_cannot_override/drive_shared_drive_managers_cannot_override.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_managers_cannot_override/drive_shared_drive_managers_cannot_override.metadata.json index adc3555dc4..62e46c2ae2 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_managers_cannot_override/drive_shared_drive_managers_cannot_override.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_managers_cannot_override/drive_shared_drive_managers_cannot_override.metadata.json @@ -13,8 +13,8 @@ "Risk": "If shared drive managers can override organizational defaults, **unauthorized data exposure** can occur when a manager intentionally or accidentally weakens a shared drive's security posture (for example, allowing external members or enabling download for viewers).", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7662202", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_members_only_access/drive_shared_drive_members_only_access.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_members_only_access/drive_shared_drive_members_only_access.metadata.json index 0949a55040..d9495ea249 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_shared_drive_members_only_access/drive_shared_drive_members_only_access.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_shared_drive_members_only_access/drive_shared_drive_members_only_access.metadata.json @@ -13,8 +13,8 @@ "Risk": "If non-members can be added to files inside a shared drive, the **drive's membership becomes meaningless** as a security control. Sensitive content scoped to a specific team can be silently extended to users who were never granted access to the drive itself, leading to unintended information disclosure.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7662202", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-shared-drives-as-an-admin", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_sharing_allowlisted_domains/drive_sharing_allowlisted_domains.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_sharing_allowlisted_domains/drive_sharing_allowlisted_domains.metadata.json index 46caa58bf7..ddba469b0b 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_sharing_allowlisted_domains/drive_sharing_allowlisted_domains.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_sharing_allowlisted_domains/drive_sharing_allowlisted_domains.metadata.json @@ -13,8 +13,8 @@ "Risk": "When external sharing is unrestricted, users can share organizational content with **any external Google account**, including untrusted or unknown parties. Restricting sharing to allowlisted domains drastically reduces the surface area for accidental and malicious data exfiltration through Drive.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.metadata.json b/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.metadata.json index e41d074a23..c788df1a27 100644 --- a/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.metadata.json +++ b/prowler/providers/googleworkspace/services/drive/drive_warn_sharing_with_allowlisted_domains/drive_warn_sharing_with_allowlisted_domains.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowlisted domains are still external. Users may not realize that even an allowlisted recipient is outside the organization, leading to **unintentional disclosure of sensitive content** to legitimate but external collaborators. A warning prompt at share time mitigates that without preventing the sharing itself.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/60781", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/drive/manage-external-sharing-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_anomalous_attachment_protection_enabled/gmail_anomalous_attachment_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_anomalous_attachment_protection_enabled/gmail_anomalous_attachment_protection_enabled.metadata.json index 77a1c68b38..2295591dba 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_anomalous_attachment_protection_enabled/gmail_anomalous_attachment_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_anomalous_attachment_protection_enabled/gmail_anomalous_attachment_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against anomalous attachment types, users may receive **emails with unusual file formats** that are designed to bypass standard security filters. Attackers may use **uncommon file extensions or MIME types** to deliver malware that evades signature-based detection.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-to-detect-harmful-attachments", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_auto_forwarding_disabled/gmail_auto_forwarding_disabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_auto_forwarding_disabled/gmail_auto_forwarding_disabled.metadata.json index 87d3111130..14484c251c 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_auto_forwarding_disabled/gmail_auto_forwarding_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_auto_forwarding_disabled/gmail_auto_forwarding_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "With auto-forwarding enabled, an attacker who gains control of a user account can create **forwarding rules to exfiltrate** all incoming email to an external address. This can persist undetected and provide the attacker with continuous access to sensitive communications even after the account is recovered.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/2491924", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/let-users-automatically-forward-their-own-gmail-emails", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_comprehensive_mail_storage_enabled/gmail_comprehensive_mail_storage_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_comprehensive_mail_storage_enabled/gmail_comprehensive_mail_storage_enabled.metadata.json index 157a3da673..530d7af908 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_comprehensive_mail_storage_enabled/gmail_comprehensive_mail_storage_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_comprehensive_mail_storage_enabled/gmail_comprehensive_mail_storage_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without comprehensive mail storage, messages sent through other Google services (Calendar, Drive, etc.) may not be stored in Gmail and therefore **not subject to Vault retention policies**. This creates gaps in **compliance coverage**, **eDiscovery**, and **audit trails** that could violate regulatory requirements.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/3547347", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-comprehensive-mail-storage", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_domain_spoofing_protection_enabled/gmail_domain_spoofing_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_domain_spoofing_protection_enabled/gmail_domain_spoofing_protection_enabled.metadata.json index 4ae8bfb3c0..7e6be13d58 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_domain_spoofing_protection_enabled/gmail_domain_spoofing_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_domain_spoofing_protection_enabled/gmail_domain_spoofing_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against domain spoofing based on similar domain names, users may receive **phishing emails from lookalike domains** (e.g., examp1e.com instead of example.com) that appear legitimate. This enables **credential theft, malware delivery, and business email compromise** attacks.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9157861", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_employee_name_spoofing_protection_enabled/gmail_employee_name_spoofing_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_employee_name_spoofing_protection_enabled/gmail_employee_name_spoofing_protection_enabled.metadata.json index b72137019a..d6d107f360 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_employee_name_spoofing_protection_enabled/gmail_employee_name_spoofing_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_employee_name_spoofing_protection_enabled/gmail_employee_name_spoofing_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against employee name spoofing, users may receive **emails that appear to come from colleagues or executives** but are actually from external attackers. This enables **business email compromise (BEC)**, **wire fraud**, and **social engineering attacks** that exploit trust relationships.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9157861", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_encrypted_attachment_protection_enabled/gmail_encrypted_attachment_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_encrypted_attachment_protection_enabled/gmail_encrypted_attachment_protection_enabled.metadata.json index 459ce1f539..3367e11777 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_encrypted_attachment_protection_enabled/gmail_encrypted_attachment_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_encrypted_attachment_protection_enabled/gmail_encrypted_attachment_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against encrypted attachments from untrusted senders, users may receive **password-protected archives containing malware** that bypass standard content scanning. Attackers commonly use encrypted attachments to evade detection and deliver **ransomware, trojans, or other malicious payloads**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-to-detect-harmful-attachments", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_enhanced_pre_delivery_scanning_enabled/gmail_enhanced_pre_delivery_scanning_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_enhanced_pre_delivery_scanning_enabled/gmail_enhanced_pre_delivery_scanning_enabled.metadata.json index 69b1be1e4b..0f14ecd73b 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_enhanced_pre_delivery_scanning_enabled/gmail_enhanced_pre_delivery_scanning_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_enhanced_pre_delivery_scanning_enabled/gmail_enhanced_pre_delivery_scanning_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without enhanced pre-delivery scanning, some **sophisticated phishing and malware** messages may pass through standard filters and be delivered to users. The additional scanning layer catches threats that the first-pass filters miss, reducing the organization's exposure to **zero-day phishing campaigns** and **targeted attacks**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7380368", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/security/help-prevent-phishing-with-pre-delivery-message-scanning", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_external_image_scanning_enabled/gmail_external_image_scanning_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_external_image_scanning_enabled/gmail_external_image_scanning_enabled.metadata.json index d6a087183c..4df5f8bd84 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_external_image_scanning_enabled/gmail_external_image_scanning_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_external_image_scanning_enabled/gmail_external_image_scanning_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without external image scanning, attackers can use **linked images to track email opens**, deliver **exploit payloads via image rendering vulnerabilities**, or use images as part of sophisticated **phishing schemes** that mimic legitimate communications.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_groups_spoofing_protection_enabled/gmail_groups_spoofing_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_groups_spoofing_protection_enabled/gmail_groups_spoofing_protection_enabled.metadata.json index 0c3dd64761..c5f5ee61a9 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_groups_spoofing_protection_enabled/gmail_groups_spoofing_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_groups_spoofing_protection_enabled/gmail_groups_spoofing_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection of groups from domain-spoofing emails, attackers can send **spoofed messages to group mailboxes** that appear to originate from the organization. Since groups distribute to many recipients, a single spoofed email can enable **mass phishing, social engineering, or misinformation** campaigns across the organization.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9157861", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_inbound_domain_spoofing_protection_enabled/gmail_inbound_domain_spoofing_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_inbound_domain_spoofing_protection_enabled/gmail_inbound_domain_spoofing_protection_enabled.metadata.json index 9e285621c8..a049a7ede5 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_inbound_domain_spoofing_protection_enabled/gmail_inbound_domain_spoofing_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_inbound_domain_spoofing_protection_enabled/gmail_inbound_domain_spoofing_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against inbound domain spoofing, users may receive **emails that appear to come from their own organization** but are sent by external attackers. This enables **internal impersonation**, **phishing**, and **business email compromise** attacks that exploit trust in internal communications.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9157861", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_mail_delegation_disabled/gmail_mail_delegation_disabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_mail_delegation_disabled/gmail_mail_delegation_disabled.metadata.json index a23cf60741..a4f9fd0460 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_mail_delegation_disabled/gmail_mail_delegation_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_mail_delegation_disabled/gmail_mail_delegation_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "If users can delegate access to their mailbox, an attacker who compromises one account could silently delegate access to maintain persistent email surveillance. This also increases the risk of **insider threats** and **data exfiltration** through shared mailbox access.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7223765", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/let-users-delegate-access-to-a-gmail-account", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_per_user_outbound_gateway_disabled/gmail_per_user_outbound_gateway_disabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_per_user_outbound_gateway_disabled/gmail_per_user_outbound_gateway_disabled.metadata.json index 2f68b3adbc..95cd7567c3 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_per_user_outbound_gateway_disabled/gmail_per_user_outbound_gateway_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_per_user_outbound_gateway_disabled/gmail_per_user_outbound_gateway_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "With per-user outbound gateways enabled, users can route outbound email through **external SMTP servers**, bypassing organizational **email security controls**, **DLP policies**, and **audit logging**. This creates an unmonitored channel for data exfiltration and policy circumvention.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/176652", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/allow-per-user-outbound-gateways", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_pop_imap_access_disabled/gmail_pop_imap_access_disabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_pop_imap_access_disabled/gmail_pop_imap_access_disabled.metadata.json index 76affe3e47..48f077d8ea 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_pop_imap_access_disabled/gmail_pop_imap_access_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_pop_imap_access_disabled/gmail_pop_imap_access_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "With POP and IMAP enabled, users can access email through **legacy clients** that rely on simple password authentication, bypassing **multifactor authentication** and other modern security controls. This significantly increases the risk of **credential-based account compromise**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/105694", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/sync/turn-pop-and-imap-on-or-off-for-users", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_script_attachment_protection_enabled/gmail_script_attachment_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_script_attachment_protection_enabled/gmail_script_attachment_protection_enabled.metadata.json index fc2a3af1b0..cae7d474ac 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_script_attachment_protection_enabled/gmail_script_attachment_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_script_attachment_protection_enabled/gmail_script_attachment_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against script-bearing attachments from untrusted senders, users may receive **files containing malicious scripts** that can execute harmful code when opened. Attackers commonly use script attachments to deliver **malware, backdoors, or credential stealers**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/set-up-rules-to-detect-harmful-attachments", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_shortener_scanning_enabled/gmail_shortener_scanning_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_shortener_scanning_enabled/gmail_shortener_scanning_enabled.metadata.json index 4ea88e92d3..518b90b962 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_shortener_scanning_enabled/gmail_shortener_scanning_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_shortener_scanning_enabled/gmail_shortener_scanning_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without shortened URL scanning, attackers can use **URL shortening services** to hide malicious destinations in phishing emails. Users cannot visually verify where the link leads, increasing the success rate of **phishing and credential harvesting** attacks.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_unauthenticated_email_protection_enabled/gmail_unauthenticated_email_protection_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_unauthenticated_email_protection_enabled/gmail_unauthenticated_email_protection_enabled.metadata.json index 6199080224..ec730d0a8b 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_unauthenticated_email_protection_enabled/gmail_unauthenticated_email_protection_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_unauthenticated_email_protection_enabled/gmail_unauthenticated_email_protection_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without protection against unauthenticated emails, users may receive **spoofed or forged messages** that fail SPF and DKIM checks but are still delivered normally. This enables **phishing**, **spam**, and **impersonation attacks** that exploit the lack of sender verification.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/9157861", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/gmail/gmail_untrusted_link_warnings_enabled/gmail_untrusted_link_warnings_enabled.metadata.json b/prowler/providers/googleworkspace/services/gmail/gmail_untrusted_link_warnings_enabled/gmail_untrusted_link_warnings_enabled.metadata.json index eb350e3b0f..78678ff9f5 100644 --- a/prowler/providers/googleworkspace/services/gmail/gmail_untrusted_link_warnings_enabled/gmail_untrusted_link_warnings_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/gmail/gmail_untrusted_link_warnings_enabled/gmail_untrusted_link_warnings_enabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "Without untrusted link warnings, users may click on **phishing links** or links to **malware distribution sites** without any warning. This significantly increases the success rate of **social engineering attacks** targeting the organization.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/7676854", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/gmail/advanced/advanced-phishing-and-malware-protection", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/groups/groups_creation_restricted/groups_creation_restricted.metadata.json b/prowler/providers/googleworkspace/services/groups/groups_creation_restricted/groups_creation_restricted.metadata.json index c2725de695..6a5bb80c3e 100644 --- a/prowler/providers/googleworkspace/services/groups/groups_creation_restricted/groups_creation_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/groups/groups_creation_restricted/groups_creation_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowing any user to create groups with external members or incoming email from outside increases the risk of **unauthorized data sharing**, **spam delivery**, and **shadow IT** groups that bypass organizational controls.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/10308022", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/groups/what-you-get-with-groups-for-business", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/groups/groups_external_access_restricted/groups_external_access_restricted.metadata.json b/prowler/providers/googleworkspace/services/groups/groups_external_access_restricted/groups_external_access_restricted.metadata.json index 3656879182..9d32063c90 100644 --- a/prowler/providers/googleworkspace/services/groups/groups_external_access_restricted/groups_external_access_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/groups/groups_external_access_restricted/groups_external_access_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowing external access to groups exposes **group names, descriptions, and membership** to anyone outside the organization, increasing the risk of **information disclosure** and enabling external parties to identify targets for **social engineering attacks**.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/10308022", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/groups/what-you-get-with-groups-for-business", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/groups/groups_view_conversations_restricted/groups_view_conversations_restricted.metadata.json b/prowler/providers/googleworkspace/services/groups/groups_view_conversations_restricted/groups_view_conversations_restricted.metadata.json index b90fe6041b..88f0927155 100644 --- a/prowler/providers/googleworkspace/services/groups/groups_view_conversations_restricted/groups_view_conversations_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/groups/groups_view_conversations_restricted/groups_view_conversations_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowing all organization users or anyone to view group conversations can lead to **information disclosure** of sensitive discussions, internal decisions, and confidential data shared within groups.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/10308022", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/groups/what-you-get-with-groups-for-business", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.metadata.json b/prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.metadata.json index 7d982370a1..78fe1850ad 100644 --- a/prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/marketplace/marketplace_apps_access_restricted/marketplace_apps_access_restricted.metadata.json @@ -13,8 +13,8 @@ "Risk": "Allowing unrestricted Marketplace app installation exposes the organization to **unvetted third-party applications** that may request broad OAuth scopes, potentially gaining access to **sensitive organizational data** including emails, documents, and calendar events without proper security review.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/6089179", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/apps/manage-the-marketplace-app-allowlist-for-your-organization", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.metadata.json b/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.metadata.json index 659360aac5..3a2c0b4566 100644 --- a/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_2sv_enforced/security_2sv_enforced.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_2sv_hardware_keys_admins/security_2sv_hardware_keys_admins.metadata.json b/prowler/providers/googleworkspace/services/security/security_2sv_hardware_keys_admins/security_2sv_hardware_keys_admins.metadata.json index 586cfc766a..4aae5840a5 100644 --- a/prowler/providers/googleworkspace/services/security/security_2sv_hardware_keys_admins/security_2sv_hardware_keys_admins.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_2sv_hardware_keys_admins/security_2sv_hardware_keys_admins.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_advanced_protection_configured/security_advanced_protection_configured.metadata.json b/prowler/providers/googleworkspace/services/security/security_advanced_protection_configured/security_advanced_protection_configured.metadata.json index 6e9d72bfdf..10c5d9e788 100644 --- a/prowler/providers/googleworkspace/services/security/security_advanced_protection_configured/security_advanced_protection_configured.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_advanced_protection_configured/security_advanced_protection_configured.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/protect-users-with-the-advanced-protection-program", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_app_access_restricted/security_app_access_restricted.metadata.json b/prowler/providers/googleworkspace/services/security/security_app_access_restricted/security_app_access_restricted.metadata.json index 9a165141b6..0945fccdec 100644 --- a/prowler/providers/googleworkspace/services/security/security_app_access_restricted/security_app_access_restricted.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_app_access_restricted/security_app_access_restricted.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_dlp_drive_rules_configured/security_dlp_drive_rules_configured.metadata.json b/prowler/providers/googleworkspace/services/security/security_dlp_drive_rules_configured/security_dlp_drive_rules_configured.metadata.json index e25e45c395..e19c3292b8 100644 --- a/prowler/providers/googleworkspace/services/security/security_dlp_drive_rules_configured/security_dlp_drive_rules_configured.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_dlp_drive_rules_configured/security_dlp_drive_rules_configured.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/about-dlp", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_internal_apps_trusted/security_internal_apps_trusted.metadata.json b/prowler/providers/googleworkspace/services/security/security_internal_apps_trusted/security_internal_apps_trusted.metadata.json index abf11509f4..e4b055f6e1 100644 --- a/prowler/providers/googleworkspace/services/security/security_internal_apps_trusted/security_internal_apps_trusted.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_internal_apps_trusted/security_internal_apps_trusted.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/apps/control-which-apps-access-google-workspace-data", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_less_secure_apps_disabled/security_less_secure_apps_disabled.metadata.json b/prowler/providers/googleworkspace/services/security/security_less_secure_apps_disabled/security_less_secure_apps_disabled.metadata.json index ef4531b758..c6c2ff57e9 100644 --- a/prowler/providers/googleworkspace/services/security/security_less_secure_apps_disabled/security_less_secure_apps_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_less_secure_apps_disabled/security_less_secure_apps_disabled.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/apps/control-access-to-less-secure-apps", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_login_challenges_configured/security_login_challenges_configured.metadata.json b/prowler/providers/googleworkspace/services/security/security_login_challenges_configured/security_login_challenges_configured.metadata.json index 0f4433ca78..ec945474fc 100644 --- a/prowler/providers/googleworkspace/services/security/security_login_challenges_configured/security_login_challenges_configured.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_login_challenges_configured/security_login_challenges_configured.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/protect-google-workspace-accounts-with-security-challenges", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_password_policy_strong/security_password_policy_strong.metadata.json b/prowler/providers/googleworkspace/services/security/security_password_policy_strong/security_password_policy_strong.metadata.json index 2bd351e93b..776c9745e8 100644 --- a/prowler/providers/googleworkspace/services/security/security_password_policy_strong/security_password_policy_strong.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_password_policy_strong/security_password_policy_strong.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/users/enforce-and-monitor-password-requirements-for-users", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_session_duration_limited/security_session_duration_limited.metadata.json b/prowler/providers/googleworkspace/services/security/security_session_duration_limited/security_session_duration_limited.metadata.json index 5cc4916945..83e89527d8 100644 --- a/prowler/providers/googleworkspace/services/security/security_session_duration_limited/security_session_duration_limited.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_session_duration_limited/security_session_duration_limited.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/security/set-session-length-for-google-services", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_super_admin_recovery_disabled/security_super_admin_recovery_disabled.metadata.json b/prowler/providers/googleworkspace/services/security/security_super_admin_recovery_disabled/security_super_admin_recovery_disabled.metadata.json index c39fb69d03..540faddac9 100644 --- a/prowler/providers/googleworkspace/services/security/security_super_admin_recovery_disabled/security_super_admin_recovery_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_super_admin_recovery_disabled/security_super_admin_recovery_disabled.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/users/allow-super-administrators-to-recover-their-password", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/security/security_user_recovery_enabled/security_user_recovery_enabled.metadata.json b/prowler/providers/googleworkspace/services/security/security_user_recovery_enabled/security_user_recovery_enabled.metadata.json index 4d3e7dcb64..0a2de745db 100644 --- a/prowler/providers/googleworkspace/services/security/security_user_recovery_enabled/security_user_recovery_enabled.metadata.json +++ b/prowler/providers/googleworkspace/services/security/security_user_recovery_enabled/security_user_recovery_enabled.metadata.json @@ -14,7 +14,7 @@ "RelatedUrl": "", "AdditionalURLs": [ "https://knowledge.workspace.google.com/admin/users/set-up-password-recovery-for-users", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { diff --git a/prowler/providers/googleworkspace/services/sites/sites_service_disabled/sites_service_disabled.metadata.json b/prowler/providers/googleworkspace/services/sites/sites_service_disabled/sites_service_disabled.metadata.json index 6422fa974b..3871b358a2 100644 --- a/prowler/providers/googleworkspace/services/sites/sites_service_disabled/sites_service_disabled.metadata.json +++ b/prowler/providers/googleworkspace/services/sites/sites_service_disabled/sites_service_disabled.metadata.json @@ -13,8 +13,8 @@ "Risk": "When Google Sites is enabled, users can create websites that may **inadvertently expose internal information** to external parties. These sites can be difficult to track and manage, creating potential **data leakage vectors** outside the organization's standard content management controls.", "RelatedUrl": "", "AdditionalURLs": [ - "https://support.google.com/a/answer/182442", - "https://cloud.google.com/identity/docs/concepts/supported-policy-api-settings" + "https://knowledge.workspace.google.com/admin/users/advanced/turn-a-service-on-or-off-for-google-workspace-users", + "https://docs.cloud.google.com/identity/docs/concepts/supported-policy-api-settings" ], "Remediation": { "Code": { From 67b26072f87bdff821dcd8bf924c82e3f41b44e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Mon, 1 Jun 2026 11:15:07 +0200 Subject: [PATCH 02/12] docs(installation): add info about updating prowler (#11404) --- .../installation/prowler-cli.mdx | 68 +++++++++++++++++-- .../installation/prowler-mcp.mdx | 39 +++++++++++ 2 files changed, 101 insertions(+), 6 deletions(-) diff --git a/docs/getting-started/installation/prowler-cli.mdx b/docs/getting-started/installation/prowler-cli.mdx index 2c79eda37c..f87653dcfe 100644 --- a/docs/getting-started/installation/prowler-cli.mdx +++ b/docs/getting-started/installation/prowler-cli.mdx @@ -40,12 +40,6 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i pip install prowler prowler -v ``` - - To upgrade Prowler to the latest version: - - ``` bash - pip install --upgrade prowler - ``` _Requirements_: @@ -170,6 +164,68 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i +## Updating Prowler CLI + +Upgrade Prowler CLI to the latest release using the same method chosen for installation: + + + + ```bash + pipx upgrade prowler + prowler -v + ``` + + + ```bash + pip install --upgrade prowler + prowler -v + ``` + + + Pull the desired image tag to fetch the latest version: + + ```bash + docker pull toniblyx/prowler:latest + ``` + + + Replace `latest` with a specific release tag (for example, `stable` or ``) to pin a version. Refer to the [Container Versions](#container-versions) section for the full list of available tags. + + + + Pull the latest changes and sync the environment: + + ```bash + cd prowler + git pull + uv sync + uv run python prowler-cli.py -v + ``` + + + To upgrade to a specific release, check out the corresponding tag before syncing: `git checkout `. + + + + ```bash + brew upgrade prowler + prowler -v + ``` + + + Both AWS CloudShell and Azure CloudShell install Prowler with `pipx`, so the upgrade command is the same: + + ```bash + pipx upgrade prowler + prowler -v + ``` + + + + + To install a specific version instead of the latest release, pin it explicitly. For example, with `pipx`: `pipx install prowler==`, or with `pip`: `pip install prowler==`. The available releases are listed in the [Releases GitHub section](https://github.com/prowler-cloud/prowler/releases). + + ## Container Versions The available versions of Prowler CLI are the following: diff --git a/docs/getting-started/installation/prowler-mcp.mdx b/docs/getting-started/installation/prowler-mcp.mdx index 7bf766e143..06f204da6a 100644 --- a/docs/getting-started/installation/prowler-mcp.mdx +++ b/docs/getting-started/installation/prowler-mcp.mdx @@ -141,6 +141,45 @@ Choose one of the following installation methods: --- +## Updating Prowler MCP Server + +When running Prowler MCP Server locally ("Option 2: Run Locally"), upgrade to the latest version using the same method chosen for installation. The hosted server (`https://mcp.prowler.com/mcp`) is always kept up to date by Prowler and requires no action. + + + + Pull the latest image and restart the container: + + ```bash + docker pull prowlercloud/prowler-mcp + ``` + + + Recreate any running container after pulling the new image so the updated version takes effect. + + + + Pull the latest changes and sync the dependencies: + + ```bash + cd prowler/mcp_server + git pull + uv sync + uv run prowler-mcp --help + ``` + + + Pull the latest source and rebuild the image: + + ```bash + cd prowler/mcp_server + git pull + docker build -t prowler-mcp . + ``` + + + +--- + ## Command Line Options The Prowler MCP Server supports the following command-line arguments: From e05519ff9fd58e202c40b182934ffa952e3125d8 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Mon, 1 Jun 2026 12:34:11 +0200 Subject: [PATCH 03/12] fix(ui): refine scans tabs and provider launch flow (#11407) --- .../wizard/steps/launch-step.test.tsx | 5 ++ .../providers/wizard/steps/launch-step.tsx | 3 +- ui/components/scans/scans-filter-bar.test.tsx | 66 +++++++++++++++++++ ui/components/scans/scans-filter-bar.tsx | 29 ++++---- ui/components/scans/scans-page-shell.test.tsx | 18 +++++ .../scans-providers-empty-state.test.tsx | 39 ++++++++++- .../scans/scans-providers-empty-state.tsx | 20 +++++- ui/components/scans/scans.utils.test.ts | 12 ++++ ui/components/scans/scans.utils.ts | 6 ++ .../scans/table/scan-jobs-columns.test.tsx | 9 ++- .../scans/table/scan-jobs-columns.tsx | 25 ++----- ui/components/scans/use-scans-filters.ts | 12 +++- 12 files changed, 203 insertions(+), 41 deletions(-) create mode 100644 ui/components/scans/scans-filter-bar.test.tsx diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx index 62a9e15d13..1f33955849 100644 --- a/ui/components/providers/wizard/steps/launch-step.test.tsx +++ b/ui/components/providers/wizard/steps/launch-step.test.tsx @@ -3,6 +3,7 @@ import type { ComponentProps } from "react"; import { beforeEach, describe, expect, it, vi } from "vitest"; import { useProviderWizardStore } from "@/store/provider-wizard/store"; +import { SCAN_JOBS_TAB } from "@/types"; import { LaunchStep } from "./launch-step"; @@ -81,5 +82,9 @@ describe("LaunchStep", () => { title: "Scan Launched", }), ); + const toastPayload = toastMock.mock.calls[0]?.[0]; + expect(toastPayload.action.props.children.props.href).toBe( + `/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`, + ); }); }); diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx index bbefb717d8..1e63f6700d 100644 --- a/ui/components/providers/wizard/steps/launch-step.tsx +++ b/ui/components/providers/wizard/steps/launch-step.tsx @@ -15,6 +15,7 @@ import { Spinner } from "@/components/shadcn/spinner/spinner"; import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon"; import { ToastAction, useToast } from "@/components/ui"; import { useProviderWizardStore } from "@/store/provider-wizard/store"; +import { SCAN_JOBS_TAB } from "@/types"; import { TREE_ITEM_STATUS } from "@/types/tree"; import { @@ -81,7 +82,7 @@ export function LaunchStep({ : "Single scan launched successfully.", action: ( - Go to scans + Go to scans ), }); diff --git a/ui/components/scans/scans-filter-bar.test.tsx b/ui/components/scans/scans-filter-bar.test.tsx new file mode 100644 index 0000000000..f629e0291b --- /dev/null +++ b/ui/components/scans/scans-filter-bar.test.tsx @@ -0,0 +1,66 @@ +import { render, screen } from "@testing-library/react"; +import { describe, expect, it, vi } from "vitest"; + +import { SCAN_JOBS_TAB } from "@/types"; + +import { ScansFilterBar } from "./scans-filter-bar"; + +vi.mock("@/components/filters/provider-account-selectors", () => ({ + ProviderAccountSelectors: () =>
Provider account selectors
, +})); + +vi.mock("@/components/shadcn", () => ({ + Select: ({ children }: { children: React.ReactNode }) => ( +
{children}
+ ), + SelectContent: ({ children }: { children: React.ReactNode }) => ( +
{children}
+ ), + SelectItem: ({ + children, + value, + }: { + children: React.ReactNode; + value: string; + }) =>
{children}
, + SelectTrigger: ({ children, ...props }: React.ComponentProps<"button">) => ( + + ), + SelectValue: ({ placeholder }: { placeholder: string }) => ( + {placeholder} + ), +})); + +const defaultProps = { + providers: [], + scheduleType: "all", + scanStatus: "all", + showStatusFilter: false, + onScheduleTypeChange: vi.fn(), + onScanStatusChange: vi.fn(), +}; + +describe("ScansFilterBar", () => { + it("hides the type filter on the scheduled tab", () => { + // Given + render( + , + ); + + // Then + expect( + screen.queryByRole("button", { name: /all types/i }), + ).not.toBeInTheDocument(); + expect(screen.getByText("Provider account selectors")).toBeInTheDocument(); + }); + + it("shows the type filter outside the scheduled tab", () => { + // Given + render( + , + ); + + // Then + expect(screen.getByRole("button", { name: /all types/i })).toBeVisible(); + }); +}); diff --git a/ui/components/scans/scans-filter-bar.tsx b/ui/components/scans/scans-filter-bar.tsx index 89ac753345..8ab48a8f9c 100644 --- a/ui/components/scans/scans-filter-bar.tsx +++ b/ui/components/scans/scans-filter-bar.tsx @@ -8,7 +8,7 @@ import { SelectTrigger, SelectValue, } from "@/components/shadcn"; -import type { ScanJobsTab } from "@/types"; +import { SCAN_JOBS_TAB, type ScanJobsTab } from "@/types"; import type { ProviderProps } from "@/types/providers"; import { @@ -40,6 +40,7 @@ export function ScansFilterBar({ const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true"; const triggerFilterOptions = getScanTriggerFilterOptions(isCloudEnvironment); const statusFilterOptions = getScanStatusFilterOptions(activeTab); + const showScheduleTypeFilter = activeTab !== SCAN_JOBS_TAB.SCHEDULED; return ( <> @@ -52,18 +53,20 @@ export function ScansFilterBar({ accountSelectorClassName={filterItemClass} /> - + {showScheduleTypeFilter && ( + + )} {showStatusFilter && (