diff --git a/prowler b/prowler index 9f0ae71307..5f8320bec1 100755 --- a/prowler +++ b/prowler @@ -67,54 +67,57 @@ usage(){ USAGE: `basename $0` [ -p -r -h ] Options: - -p specify your AWS profile to use (i.e.: default) - -r specify an AWS region to direct API requests to - (i.e.: us-east-1), all regions are checked anyway if the check requires it - -c specify one or multiple check ids separated by commas, to see all available checks use "-l" option + -p Specify your AWS profile to use. + (i.e.: default) + -r Specify an AWS region to direct API requests to. + (i.e.: us-east-1), all regions are checked anyway if the check requires it. + -c Specify one or multiple check ids separated by commas, to see all available checks use "-l" option. (i.e.: "check11" for check 1.1 or "extra71,extra72" for extra check 71 and extra check 72) -C Checklist file. See checklist.txt for reference and format. (i.e.: checklist.txt) - -g specify a group of checks by id, to see all available group of checks use "-L" + -g Specify a group of checks by id, to see all available group of checks use "-L". (i.e.: "group3" for entire section 3, "cislevel1" for CIS Level 1 Profile Definitions or "forensics-ready") - -f specify an AWS region to run checks against + -f Specify an AWS region to run checks against. (i.e.: us-west-1 or for multiple regions use single quote like 'us-west-1 us-west-2') - -m specify the maximum number of items to return for long-running requests (default: 100) - -M output mode: text (default), mono, html, json, json-asff, junit-xml, csv. They can be used combined comma separated. - (separator is ","; data is on stdout; progress on stderr). - -k keep the credential report - -n show check numbers to sort easier + -m Specify the maximum number of items to return for long-running requests (default: 100). + -M Output or report mode: text (default), mono, html, json, json-asff, junit-xml, csv. They can be used combined comma separated. + (i.e.: "html,json"; files created in background; progress on stdout) + -k Keep the credential report for debugging. + -n Show check numbers to sort easier. (i.e.: 1.01 instead of 1.1) - -l list all available checks only (does not perform any check). Add -g to only list checks within the specified group - -L list all groups (does not perform any check) - -e exclude group extras - -E execute all tests except a list of specified checks separated by comma (i.e. check21,check31) - -b do not print Prowler banner - -s show scoring report - -S send check output to AWS Security Hub - only valid when the output mode is json-asff (i.e. "-M json-asff -S") - -x specify external directory with custom checks (i.e. /my/own/checks, files must start by "check") - -q get only FAIL findings, will show WARNINGS when a resource is excluded - -A account id for the account where to assume a role, requires -R and -T + -l List all available checks only (does not perform any check). Add -g to only list checks within the specified group. + -L List all groups (does not perform any check). + -e Exclude group extras. + -E Execute all tests except a list of specified checks separated by comma. + (i.e. check21,check31) + -b Do not print Prowler banner. + -s Show scoring report (it is included by default in the html report). + -S Send check output to AWS Security Hub. Only valid when the output mode is json-asff + (i.e. "-M json-asff -S"). + -x Specify external directory with custom checks + (i.e. /my/own/checks, files must start by "check"). + -q Get only FAIL findings, will show WARNINGS when a resource is excluded. + -A Account id for the account where to assume a role, requires -R. (i.e.: 123456789012) - -R role name or role arn to assume in the account, requires -A and -T + -R Role name or role arn to assume in the account, requires -A. (i.e.: ProwlerRole) - -T session duration given to that role credentials in seconds, default 1h (3600) recommended 12h, optional with -R and -A + -T Session duration given to that role credentials in seconds, default 1h (3600) recommended 12h, optional with -R and -A. (i.e.: 43200) - -I External ID to be used when assuming roles (not mandatory), requires -A and -R - -w whitelist file. See whitelist_sample.txt for reference and format + -I External ID to be used when assuming roles (not mandatory), requires -A and -R. + -w Whitelist file. See whitelist_sample.txt for reference and format. (i.e.: whitelist_sample.txt) -N Shodan API key used by check extra7102. - -o Custom output directory, if not specified will use default prowler/output, requires -M + -o Custom output directory, if not specified will use default prowler/output, requires -M . (i.e.: -M csv -o /tmp/reports/) -B Custom output bucket, requires -M and it can work also with -o flag. (i.e.: -M csv -B my-bucket or -M csv -B my-bucket/folder/) - -D Same as -B but do not use the assume role credentials to put objects to the bucket, instead - uses the initial credentials - -F Custom output report name, if not specified will use default output/prowler-output-ACCOUNT_NUM-OUTPUT_DATE - -z Failed Checks do not trigger exit code 3 + -D Same as -B but do not use the assumed role credentials to put objects to the bucket, instead uses the initial credentials. + -F Custom output report name, if not specified will use default output/prowler-output-ACCOUNT_NUM-OUTPUT_DATE.format. + -z Failed checks do not trigger exit code 3. -Z Specify one or multiple check ids separated by commas that will trigger exit code 3 if they fail. Unspecified checks will not trigger exit code 3. This will override "-z". - (i.e.: "-Z check11,check12" will cause check11 and/or check12 to trigger exit code 3 - -V show version number & exit - -h this help + (i.e.: "-Z check11,check12" will cause check11 and/or check12 to trigger exit code 3) + -V Show version number & exit. + -h This help. " exit }