From a2766ba28b969d50d32f7e341d32ef83d01dd172 Mon Sep 17 00:00:00 2001
From: "Andoni A." <14891798+andoniaf@users.noreply.github.com>
Date: Tue, 24 Feb 2026 16:05:10 +0100
Subject: [PATCH] feat(image): enable misconfig scanner by default for image
 scans

---
 prowler/providers/image/image_provider.py     | 23 ++++++++++++++++++-
 .../image/lib/arguments/arguments.py          |  4 ++--
 tests/providers/image/image_provider_test.py  |  2 +-
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/prowler/providers/image/image_provider.py b/prowler/providers/image/image_provider.py
index 15f4e14093..d9492806f2 100644
--- a/prowler/providers/image/image_provider.py
+++ b/prowler/providers/image/image_provider.py
@@ -85,7 +85,9 @@ class ImageProvider(Provider):
 
         self.images = images if images is not None else []
         self.image_list_file = image_list_file
-        self.scanners = scanners if scanners is not None else ["vuln", "secret"]
+        self.scanners = (
+            scanners if scanners is not None else ["vuln", "secret", "misconfig"]
+        )
         self.image_config_scanners = (
             image_config_scanners if image_config_scanners is not None else []
         )
@@ -319,6 +321,25 @@ class ImageProvider(Provider):
             return parts[0]
         return None
 
+    @staticmethod
+    def _is_registry_url(image_uid: str) -> bool:
+        """Determine whether an image UID is a registry URL (namespace only).
+
+        Bare hostnames like "714274078102.dkr.ecr.eu-west-1.amazonaws.com"
+        or "myregistry.com:5000" are registry URLs (dots in host, no slash).
+        Image references like "alpine:3.18" or "nginx" are not.
+        """
+        if "/" not in image_uid:
+            host_part = image_uid.split(":")[0]
+            if "." in host_part:
+                return True
+
+        registry_host = ImageProvider._extract_registry(image_uid)
+        if not registry_host:
+            return False
+        repo_and_tag = image_uid[len(registry_host) + 1 :]
+        return "/" not in repo_and_tag and ":" not in repo_and_tag
+
     def cleanup(self) -> None:
         """Clean up any resources after scanning."""
 
diff --git a/prowler/providers/image/lib/arguments/arguments.py b/prowler/providers/image/lib/arguments/arguments.py
index 3dfe9cf92b..529061befc 100644
--- a/prowler/providers/image/lib/arguments/arguments.py
+++ b/prowler/providers/image/lib/arguments/arguments.py
@@ -50,9 +50,9 @@ def init_parser(self):
         "--scanner",
         dest="scanners",
         nargs="+",
-        default=["vuln", "secret"],
+        default=["vuln", "secret", "misconfig"],
         choices=SCANNERS_CHOICES,
-        help="Trivy scanners to use. Default: vuln, secret. Available: vuln, secret, misconfig, license",
+        help="Trivy scanners to use. Default: vuln, secret, misconfig. Available: vuln, secret, misconfig, license",
     )
 
     scan_config_group.add_argument(
diff --git a/tests/providers/image/image_provider_test.py b/tests/providers/image/image_provider_test.py
index 32fd92f45a..ee898b68c2 100644
--- a/tests/providers/image/image_provider_test.py
+++ b/tests/providers/image/image_provider_test.py
@@ -53,7 +53,7 @@ class TestImageProvider:
         assert provider._type == "image"
         assert provider.type == "image"
         assert provider.images == ["alpine:3.18"]
-        assert provider.scanners == ["vuln", "secret"]
+        assert provider.scanners == ["vuln", "secret", "misconfig"]
         assert provider.image_config_scanners == []
         assert provider.trivy_severity == []
         assert provider.ignore_unfixed is False