mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-10-19 18:04:17 +00:00
Merge master
This commit is contained in:
mintlify-bot committed
commit
aecac60c12
2428 files changed
+134745
-24745
No files matched your search
@@ -64,6 +64,7 @@ The following list includes all the AWS checks with configurable variables that
|
||||
| `dynamodb_table_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
|
||||
| `ec2_elastic_ip_shodan` | `shodan_api_key` | String | `null` |
|
||||
| `ec2_instance_older_than_specific_days` | `max_ec2_instance_age_in_days` | Integer | `180` |
|
||||
| `ec2_instance_stopped_older_than_specific_days` | `max_ec2_instance_stopped_days` | Integer | `30` |
|
||||
| `ec2_instance_secrets_user_data` | `secrets_ignore_patterns` | List of Strings | `[]` |
|
||||
| `ec2_launch_template_no_secrets` | `secrets_ignore_patterns` | List of Strings | `[]` |
|
||||
| `ec2_securitygroup_allow_ingress_from_internet_to_any_port` | `ec2_allowed_instance_owners` | List of Strings | `["amazon-elb"]` |
|
||||
@@ -79,6 +80,7 @@ The following list includes all the AWS checks with configurable variables that
|
||||
| `elasticache_redis_cluster_backup_enabled` | `minimum_snapshot_retention_period` | Integer | `7` |
|
||||
| `elb_is_in_multiple_az` | `elb_min_azs` | Integer | `2` |
|
||||
| `elbv2_is_in_multiple_az` | `elbv2_min_azs` | Integer | `2` |
|
||||
| `elbv2_listener_pqc_tls_enabled` | `elbv2_listener_pqc_tls_allowed_policies` | List of Strings | See `config.yaml` |
|
||||
| `eventbridge_bus_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
|
||||
| `eventbridge_schema_registry_cross_account_access` | `trusted_account_ids` | List of Strings | `[]` |
|
||||
| `glue_etl_jobs_no_secrets_in_arguments` | `secrets_ignore_patterns` | List of Strings | `[]` |
|
||||
@@ -392,6 +394,8 @@ aws:
|
||||
max_security_group_rules: 50
|
||||
# aws.ec2_instance_older_than_specific_days --> by default is 6 months (180 days)
|
||||
max_ec2_instance_age_in_days: 180
|
||||
# aws.ec2_instance_stopped_older_than_specific_days --> by default is 30 days
|
||||
max_ec2_instance_stopped_days: 30
|
||||
# aws.ec2_securitygroup_allow_ingress_from_internet_to_any_port
|
||||
# allowed network interface types for security groups open to the Internet
|
||||
ec2_allowed_interface_types:
|
||||
|
||||
@@ -5,13 +5,13 @@ description: "Use --custom-checks-metadata-file in Prowler CLI to override defau
|
||||
|
||||
In certain organizations, the severity of specific checks might differ from the default values defined in the check's metadata. For instance, while `s3_bucket_level_public_access_block` could be deemed `critical` for some organizations, others might assign a different severity level to it.
|
||||
|
||||
The custom metadata option offers a means to override default metadata set by Prowler
|
||||
The custom metadata option offers a means to override default metadata set by Prowler.
|
||||
|
||||
You can utilize `--custom-checks-metadata-file` followed by the path to your custom checks metadata YAML file.
|
||||
|
||||
## Available Fields
|
||||
|
||||
The list of supported check's metadata fields that can be override are listed as follows:
|
||||
The list of supported check's metadata fields that can be overridden are listed as follows:
|
||||
|
||||
- Severity
|
||||
- CheckTitle
|
||||
|
||||
@@ -3,7 +3,7 @@ title: "Run the Prowler local dashboard from CSV outputs"
|
||||
description: "Launch the built-in Prowler dashboard to visualize CSV scan output locally or in Docker, exposing an interactive UI on port 11666 for review."
|
||||
---
|
||||
|
||||
Prowler allows you to run your own local dashboards using the csv outputs provided by Prowler
|
||||
Prowler Local Dashboard is a local web dashboard built from the CSV outputs produced by Prowler CLI. Launch it with:
|
||||
|
||||
```sh
|
||||
prowler dashboard
|
||||
@@ -13,7 +13,7 @@ prowler dashboard
|
||||
You can expose the `dashboard` server in another address using the `HOST` environment variable.
|
||||
|
||||
</Note>
|
||||
To run Prowler local dashboard with Docker, use:
|
||||
To run Prowler Local Dashboard with Docker, use:
|
||||
|
||||
```sh
|
||||
docker run -v /your/local/dir/prowler-output:/home/prowler/output --env HOST=0.0.0.0 --publish 127.0.0.1:11666:11666 toniblyx/prowler:latest dashboard
|
||||
@@ -37,7 +37,7 @@ This page allows for multiple functions:
|
||||
|
||||
- Apply filters:
|
||||
|
||||
- Assesment Date
|
||||
- Assessment Date
|
||||
- Account
|
||||
- Region
|
||||
- Severity
|
||||
@@ -46,7 +46,7 @@ This page allows for multiple functions:
|
||||
- Status
|
||||
- Category
|
||||
|
||||
- See which files has been scanned to generate the dashboard by placing your mouse on the `?` icon:
|
||||
- See which files have been scanned to generate the dashboard by placing your mouse on the `?` icon:
|
||||
|
||||
{" "}
|
||||
<img src="/images/cli/dashboard/dashboard-files-scanned.png" />
|
||||
@@ -68,7 +68,7 @@ This page shows all the info related to the compliance selected. Multiple filter
|
||||
|
||||
To add your own compliance to compliance page, add a file with the compliance name (using `_` instead of `.`) to the path `/dashboard/compliance`.
|
||||
|
||||
In this file use the format present in the others compliance files to create the table. Example for CIS 2.0:
|
||||
In this file use the format present in the other compliance files to create the table. Example for CIS 2.0:
|
||||
|
||||
```python
|
||||
import warnings
|
||||
|
||||
@@ -34,9 +34,9 @@ To configure the Slack Integration, follow the next steps:
|
||||
2. Optionally, create a Slack Channel (you can use an existing one)
|
||||
|
||||
3. Integrate the created Slack App to your Slack channel:
|
||||
- Click on the channel, go to the Integrations tab, and Add an App.
|
||||
- Click the channel, go to the Integrations tab, and Add an App.
|
||||
|
||||
|
||||
4. Set the following environment variables that Prowler will read:
|
||||
- `SLACK_API_TOKEN`: the *Slack App OAuth Token* that was previously get.
|
||||
- `SLACK_API_TOKEN`: the *Slack App OAuth Token* that was previously obtained.
|
||||
- `SLACK_CHANNEL_NAME`: the name of your Slack Channel where Prowler will send the message.
|
||||
@@ -3,7 +3,7 @@ title: 'Prowler CLI logging levels and log file output'
|
||||
description: 'Configure Prowler CLI log levels with --log-level and route DEBUG, INFO, WARNING, ERROR, or CRITICAL messages to a file with --log-file for troubleshooting.'
|
||||
---
|
||||
|
||||
Prowler has a logging feature to be as transparent as possible, so that you can see every action that is being performed whilst the tool is being executing.
|
||||
Prowler has a logging feature to be as transparent as possible, so that you can see every action that is being performed whilst the tool is being executed.
|
||||
|
||||
## Set Log Level
|
||||
|
||||
|
||||
@@ -319,11 +319,11 @@ The DynamoDB Table must have the following String keys:
|
||||
|
||||
The Mutelist Table must have the following columns:
|
||||
|
||||
- Accounts (String): This field can contain either an Account ID or an `*` (which applies to all the accounts that use this table as an mutelist).
|
||||
- Accounts (String): This field can contain either an Account ID or an `*` (which applies to all the accounts that use this table as a mutelist).
|
||||
|
||||
- Checks (String): This field can contain either a Prowler Check Name or an `*` (which applies to all the scanned checks).
|
||||
|
||||
- Regions (List): This field contains a list of regions where this mutelist rule is applied (it can also contains an `*` to apply all scanned regions).
|
||||
- Regions (List): This field contains a list of regions where this mutelist rule is applied (it can also contain an `*` to apply all scanned regions).
|
||||
|
||||
- Resources (List): This field contains a list of regular expressions (regex) that applies to the resources that are wanted to be muted.
|
||||
|
||||
@@ -359,7 +359,7 @@ Make sure that the credentials that Prowler uses can invoke the Lambda Function:
|
||||
Resource: arn:aws:lambda:REGION:ACCOUNT_ID:function:FUNCTION_NAME
|
||||
```
|
||||
|
||||
The Lambda Function can then generate an Mutelist dynamically. Here is the code an example Python Lambda Function that generates an Mutelist:
|
||||
The Lambda Function can then generate a Mutelist dynamically. Here is the code of an example Python Lambda Function that generates a Mutelist:
|
||||
|
||||
```
|
||||
def handler(event, context):
|
||||
|
||||
@@ -134,9 +134,9 @@ Write-Host "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - All jobs completed"
|
||||
|
||||
Output will be stored in `C:\Users\YOUR-USER\Documents\output\`
|
||||
|
||||
## Combining the output files
|
||||
## Combining the Output Files
|
||||
|
||||
Guidance is provided for the CSV file format. From the ouput directory, execute either the following Bash or PowerShell script. The script will collect the output from the CSV files, only include the header from the first file, and then output the result as CombinedCSV.csv in the current working directory.
|
||||
Guidance is provided for the CSV file format. From the output directory, execute either the following Bash or PowerShell script. The script will collect the output from the CSV files, only include the header from the first file, and then output the result as CombinedCSV.csv in the current working directory.
|
||||
|
||||
There is no logic implemented in terms of which CSV files it will combine. If you have additional CSV files from other actions, such as running a quick inventory, you will need to move that out of the current (or any nested) directory, or move the output you want to combine into its own folder and run the script from there.
|
||||
|
||||
@@ -185,7 +185,7 @@ $combinedCsv | Export-Csv -Path "CombinedCSV.csv" -NoTypeInformation
|
||||
|
||||
## TODO: Additional Improvements
|
||||
|
||||
Some services need to instantiate another service to perform a check. For instance, `cloudwatch` will instantiate Prowler's `iam` service to perform the `cloudwatch_cross_account_sharing_disabled` check. When the `iam` service is instantiated, it will perform the `__init__` function, and pull all the information required for that service. This provides an opportunity for an improvement in the above script to group related services together so that the `iam` services (or any other cross-service references) isn't repeatedily instantiated by grouping dependant services together. A complete mapping between these services still needs to be further investigated, but these are the cross-references that have been noted:
|
||||
Some services need to instantiate another service to perform a check. For instance, `cloudwatch` will instantiate Prowler's `iam` service to perform the `cloudwatch_cross_account_sharing_disabled` check. When the `iam` service is instantiated, it will perform the `__init__` function, and pull all the information required for that service. This provides an opportunity for an improvement in the above script to group related services together so that the `iam` services (or any other cross-service references) aren't repeatedly instantiated by grouping dependent services together. A complete mapping between these services still needs to be further investigated, but these are the cross-references that have been noted:
|
||||
|
||||
* inspector2 needs lambda and ec2
|
||||
* cloudwatch needs iam
|
||||
|
||||
@@ -19,7 +19,7 @@ Currently, it is only available for AWS provider.
|
||||
By default, it extracts resources from all the regions, you could use `-f`/`--filter-region` to specify the regions to execute the analysis.
|
||||
|
||||
</Note>
|
||||
- This feature specify both the number of resources for each service and for each resource type.
|
||||
- This feature specifies both the number of resources for each service and for each resource type.
|
||||
|
||||
- Also, it creates by default a CSV and JSON to see detailed information about the resources extracted.
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ prowler <provider> -M csv json-ocsf json-asff -o <custom_report_directory>
|
||||
Both flags can be used simultaneously to provide a custom directory and filename. `console prowler <provider> -M csv json-ocsf json-asff \ -F <custom_report_name> -o <custom_report_directory>`
|
||||
|
||||
</Note>
|
||||
## Output timestamp format
|
||||
## Output Timestamp Format
|
||||
|
||||
By default, the timestamp format of the output files is ISO 8601. This can be changed with the flag `--unix-timestamp` generating the timestamp fields in pure unix timestamp format.
|
||||
|
||||
@@ -115,7 +115,7 @@ The CSV format follows a standardized structure across all providers. The follow
|
||||
|
||||
#### CSV Headers Mapping
|
||||
|
||||
The following table shows the mapping between the CSV headers and the the providers fields:
|
||||
The following table shows the mapping between the CSV headers and the providers fields:
|
||||
|
||||
| Open Source Consolidated| AWS| GCP| AZURE| KUBERNETES
|
||||
|----------|----------|----------|----------|----------
|
||||
|
||||
Reference in new issue
Block a user