Merge master

docs/user-guide/cli/tutorials/configuration_file.mdx

@@ -52,6 +52,7 @@ The following list includes all the AWS checks with configurable variables that
 | `cloudtrail_threat_detection_privilege_escalation`                     | `threat_detection_privilege_escalation_actions`   | List of Strings | See `config.yaml`                                                                                                                    |
 | `cloudtrail_threat_detection_privilege_escalation`                     | `threat_detection_privilege_escalation_minutes`   | Integer         | `1440`                                                                                                                               |
 | `cloudtrail_threat_detection_privilege_escalation`                     | `threat_detection_privilege_escalation_threshold` | Float           | `0.2`                                                                                                                                |
+| `cloudwatch_log_group_agentcore_data_protection_policy_enabled`        | `agentcore_log_group_name_prefixes`               | List of Strings | See `config.yaml`                                                                                                                    |
 | `cloudwatch_log_group_no_secrets_in_logs`                              | `secrets_ignore_patterns`                         | List of Strings | `[]`                                                                                                                                 |
 | `cloudwatch_log_group_retention_policy_specific_days_enabled`          | `log_group_retention_days`                        | Integer         | `365`                                                                                                                                |
 | `codebuild_project_no_secrets_in_variables`                            | `excluded_sensitive_environment_variables`        | List of Strings | `[]`                                                                                                                                 |
@@ -91,6 +92,8 @@ The following list includes all the AWS checks with configurable variables that
 | `iam_user_access_not_stale_to_sagemaker`                               | `max_unused_sagemaker_access_days`                | Integer         | `90`                                                                                                                                 |
 | `iam_user_accesskey_unused`                                            | `max_unused_access_keys_days`                     | Integer         | `45`                                                                                                                                 |
 | `iam_user_console_access_unused`                                       | `max_console_access_days`                         | Integer         | `45`                                                                                                                                 |
+| `inspector2_active_findings_within_max_age`                            | `inspector2_active_finding_max_age_days`          | Integer         | `192`                                                                                                                                |
+| `inspector2_coverage_recently_scanned`                                 | `inspector2_max_days_since_last_scan`             | Integer         | `3`                                                                                                                                  |
 | `kinesis_stream_data_retention_period`                                 | `min_kinesis_stream_retention_hours`              | Integer         | `168`                                                                                                                                |
 | `neptune_cluster_backup_enabled`                                       | `minimum_backup_retention_period`                 | Integer         | `7`                                                                                                                                  |
 | `opensearch_service_domains_not_publicly_accessible`                   | `trusted_ips`                                     | List of Strings | `[]`                                                                                                                                 |
@@ -490,6 +493,14 @@ aws:
   # MEDIUM
   ecr_repository_vulnerability_minimum_severity: "MEDIUM"
 
+  # AWS Inspector2
+  # aws.inspector2_coverage_recently_scanned
+  # Maximum days since Inspector2 last scanned an actively covered resource
+  inspector2_max_days_since_last_scan: 3
+  # aws.inspector2_active_findings_within_max_age
+  # Maximum days an Inspector2 finding can stay active since it was first observed
+  inspector2_active_finding_max_age_days: 192
+
   # AWS Trusted Advisor
   # aws.trustedadvisor_premium_support_plan_subscribed
   verify_premium_support_plans: True

docs/user-guide/cli/tutorials/fixer.mdx

@@ -106,7 +106,7 @@ def fixer(resource_id: str) -> bool:
         return True
 ```
 
-## Fixer Config file
+## Fixer Config File
 
 For some fixers, you can have configurable parameters depending on your use case. You can either use the default config file in `prowler/config/fixer_config.yaml` or create a custom config file and pass it to the fixer with the `--fixer-config` flag. The config file should be a YAML file with the following structure:
 

docs/user-guide/cli/tutorials/misc.mdx

@@ -5,7 +5,7 @@ description: 'Show Prowler version, enable verbose mode, tune execution behavior
 
 ## Prowler Version
 
-### Showing the Prowler version:
+### Showing the Prowler Version
 
 ```console
 prowler <provider> -V/-v/--version
@@ -23,7 +23,7 @@ To enable verbose mode in Prowler, similar to Version 2, use:
 prowler <provider> --verbose
 ```
 
-### Filter findings by status
+### Filter Findings by Status
 
 Prowler allows filtering findings based on their status, ensuring reports and CLI display only relevant findings:
 

docs/user-guide/cli/tutorials/mutelist.mdx

@@ -269,7 +269,7 @@ Accounts:
 
 ## AWS Mutelist
 
-### Muting specific AWS regions
+### Muting Specific AWS Regions
 
 If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`:
 

docs/user-guide/cli/tutorials/pentesting.mdx

@@ -44,8 +44,7 @@ prowler <provider> --categories secrets
 
 Several checks analyse resources that are exposed to the Internet, these are:
 
-1. apigateway\_restapi\_public
-
+- apigateway\_restapi\_public
 - appstream\_fleet\_default\_internet\_access\_disabled
 - awslambda\_function\_not\_publicly\_accessible
 - ec2\_ami\_public
@@ -59,8 +58,6 @@ Several checks analyse resources that are exposed to the Internet, these are:
 - ecr\_repositories\_not\_publicly\_accessible
 - eks\_control\_plane\_endpoint\_access\_restricted
 - eks\_endpoints\_not\_publicly\_accessible
-- eks\_control\_plane\_endpoint\_access\_restricted
-- eks\_endpoints\_not\_publicly\_accessible
 - elbv2\_internet\_facing
 - kms\_key\_not\_publicly\_accessible
 - opensearch\_service\_domains\_not\_publicly\_accessible

docs/user-guide/providers/alibabacloud/getting-started-alibabacloud.mdx

@@ -145,25 +145,25 @@ prowler alibabacloud --ecs-ram-role RoleName
 
 ### Step 2: Run the First Scan
 
-#### Scan all regions
+#### Scan All Regions
 
 ```bash
 prowler alibabacloud
 ```
 
-#### Scan specific regions
+#### Scan Specific Regions
 
 ```bash
 prowler alibabacloud --region cn-hangzhou cn-shanghai
 ```
 
-#### Run specific checks
+#### Run Specific Checks
 
 ```bash
 prowler alibabacloud --checks ram_no_root_access_key ram_user_mfa_enabled_console_access
 ```
 
-#### Run a compliance framework
+#### Run a Compliance Framework
 
 ```bash
 prowler alibabacloud --compliance cis_2.0_alibabacloud

docs/user-guide/providers/aws/boto3-configuration.mdx

@@ -3,13 +3,38 @@ title: 'Boto3 Retry Configuration for AWS Scans'
 description: 'Tune Prowler AWS scans with Boto3 standard retry mode: adjust max attempts, handle throttling errors, and validate retries with debug logs.'
 ---
 
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 Prowler's AWS Provider leverages Boto3's [Standard](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html) retry mode to automatically retry client calls to AWS services when encountering errors or exceptions.
 
+## Timeout Configuration
+
+<VersionBadge version="5.42.0" />
+
+Every AWS API call is bounded by two timeouts:
+
+- Connect timeout: seconds to wait to establish a connection (TCP, proxy tunnel and TLS handshake) to the AWS endpoint. Prowler's default is 10 seconds, configurable via `--aws-connect-timeout 5`.
+- Read timeout: seconds to wait for a response once connected. Prowler's default is 60 seconds, configurable via `--aws-read-timeout 30`.
+
+Both timeouts can also be set through environment variables, which is the way to tune them in Prowler Cloud and other deployments without a CLI:
+
+```console
+export PROWLER_AWS_BOTO3_CONNECT_TIMEOUT=5
+export PROWLER_AWS_BOTO3_READ_TIMEOUT=30
+```
+
+CLI flags take precedence over the environment variables. Prowler sets both timeouts explicitly, so `AWS_DEFAULTS_MODE` and a `connect_timeout` in `~/.aws/config` are ignored; use the flag or the environment variable instead.
+
+<Note>
+Boto3 defaults both timeouts to 60 seconds. In networks with restricted egress (for example VPC endpoints for a subset of services, GovCloud or private deployments), every AWS service without a reachable endpoint used to cost up to 4 attempts × 60 seconds (the first call plus the 3 retries) for each region. Prowler lowers the connect timeout to 10 seconds so unreachable endpoints fail fast; lower it further together with `--aws-retries-max-attempts 0`, which disables retries and leaves a single attempt per call, if a scan still spends most of its time waiting on unreachable services.
+
+</Note>
+
 ## Retry Behavior Overview
 
 Boto3's Standard retry mode includes the following mechanisms:
 
-- Maximum Retry Attempts: Default value set to 3, configurable via the `--aws-retries-max-attempts 5` argument.
+- Maximum Retry Attempts: Default value set to 3, configurable via the `--aws-retries-max-attempts 5` argument. `0` disables retries.
 
 - Expanded Error Handling: Retries occur for a comprehensive set of errors.
 

docs/user-guide/providers/aws/organizations.mdx

@@ -168,7 +168,7 @@ Include the `ExternalId` parameter in the StackSet if required by the organizati
 
 When encountering issues during deployment or needing to target specific OUs or environments (e.g., dev/staging/prod), reach out to the Prowler team via [Slack Community](https://prowler.com/slack) or [Support](mailto:support@prowler.com).
 
-## Extra: Run Prowler across all accounts in AWS Organizations by assuming roles
+## Extra: Run Prowler Across All Accounts in AWS Organizations by Assuming Roles
 
 ### Running Prowler Across All AWS Organization Accounts
 

docs/user-guide/providers/aws/regions-and-partitions.mdx

@@ -22,10 +22,30 @@ When scanning the China (`aws-cn`), European Sovereign Cloud (`aws-eusc`) or Gov
 
 - Specify the regions to audit within that partition using the `-f/--region` flag.
 
+- Declare the partition with the `PROWLER_AWS_PARTITION` environment variable, set to `aws`, `aws-cn`, `aws-eusc` or `aws-us-gov`.
+
 <Note>
 Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.
 
 </Note>
+### Declaring the Partition
+
+`PROWLER_AWS_PARTITION` tells Prowler which partition the scan runs against, without relying on a region being configured:
+
+```bash
+export PROWLER_AWS_PARTITION="aws-us-gov"
+```
+
+It matters most where nothing else says. Resolving an identity means calling STS before anything is known about the credentials, and with no region configured Prowler would otherwise start from the commercial endpoints. Declaring the partition makes that first call go to the right place, which is the difference between a scan that starts and one that fails on an endpoint the credentials cannot use.
+
+A region configured for the session still wins when it belongs to the declared partition, so a deployment in `us-gov-west-1` is not sent to `us-gov-east-1`. A region belonging to a different partition is ignored, since a partition that has been declared explicitly is the more deliberate statement of the two.
+
+When no configured region says which one to prefer, the first region of the partition is tried, and up to two more follow if it cannot be reached. A network that routes to only one region of its partition therefore works without having to declare which one that is. Only a connection failure moves on to the next region: a credential error is reported from the first, since it would be the same everywhere. A region excluded from the scan is tried last, so it is avoided whenever another region of the partition answers.
+
+<Note>
+Set it wherever the scan runs. For deployments that scan from containers, that means the environment of the containers doing the scanning, not only the one accepting the request.
+</Note>
+
 ### Scanning Specific Regions
 
 To scan a particular AWS region with Prowler, use:

docs/user-guide/providers/cloudflare/authentication.mdx

@@ -23,9 +23,12 @@ Prowler requires read-only access to Cloudflare zones and their settings. The fo
 | Resource | Permission | Access | Description |
 |----------|------------|--------|-------------|
 | `Account` | `Account Settings` | `Read` | Required to list accounts and verify user identity |
-| `Zone` | `Zone` | `Read` | Required to list zones, rulesets, bot management, and SSL settings |
-| `Zone` | `Zone Settings` | `Read` | Required to read zone security settings (TLS, HSTS, WAF, etc.) |
-| `Zone` | `DNS` | `Read` | Required to read DNS records and DNSSEC status |
+| `Zone` | `Zone` | `Read` | Required to list zones |
+| `Zone` | `Zone Settings` | `Read` | Required to read zone security settings (SSL/TLS mode, TLS versions, HSTS, Always Use HTTPS, WAF, etc.) |
+| `Zone` | `DNS` | `Read` | Required to read DNS records (SPF, DMARC, DKIM, CAA) and DNSSEC status |
+| `Zone` | `SSL and Certificates` | `Read` | Required to read Universal SSL settings |
+| `Zone` | `Bot Management` | `Read` | Required to read Bot Fight Mode |
+| `Zone` | `Zone WAF` | `Read` | Required to read WAF custom, rate limiting, and managed rulesets |
 
 <Warning>
 Ensure the API Token has access to all zones targeted for scanning. Missing permissions may cause some checks to fail or return incomplete results.
@@ -47,8 +50,8 @@ Create a **User API Token**, not an Account API Token. User API Tokens are creat
 
 **Quick Setup:** Use these pre-configured links to open the Cloudflare Dashboard with the required permissions already selected:
 
-- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a **User API Token** (recommended). Opens the **Create Custom Token** form prefilled with the four required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the name `Prowler Security Scanner`. Adjust **Account Resources** and **Zone Resources** to match the accounts and zones you want to scan, then click **Create Token**.
-- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/) instead. Use this for automation or CI/CD where the token should not depend on a specific user account remaining active. Requires the **Super Administrator** or **Administrator** role on the account.
+- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a **User API Token** (recommended). Opens the **Create Custom Token** form prefilled with the seven required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`, `SSL and Certificates`, `Bot Management`, `Zone WAF`) and the name `Prowler Security Scanner`. Adjust **Account Resources** and **Zone Resources** to match the accounts and zones you want to scan, then click **Create Token**.
+- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/) instead. Use this for automation or CI/CD where the token should not depend on a specific user account remaining active. Requires the **Super Administrator** or **Administrator** role on the account.
 
 <Note>
 Template URLs only pre-fill the token creation form. Review the permissions, configure resources, and click **Create Token** to complete the process.
@@ -67,6 +70,9 @@ Template URLs only pre-fill the token creation form. Review the permissions, con
      - `Zone` — `Zone` — `Read`
      - `Zone` — `Zone Settings` — `Read`
      - `Zone` — `DNS` — `Read`
+     - `Zone` — `SSL and Certificates` — `Read`
+     - `Zone` — `Bot Management` — `Read`
+     - `Zone` — `Zone WAF` — `Read`
    - **Zone Resources:** Select either:
      - **Include → All zones** (to scan all zones in the account)
      - **Include → Specific zone** (to limit access to specific zones)

docs/user-guide/providers/cloudflare/getting-started-cloudflare.mdx

@@ -12,16 +12,16 @@ Prowler for Cloudflare scans zones for security misconfigurations, including SSL
 Set up authentication for Cloudflare with the [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication) guide before starting either path:
 
 - Create a Cloudflare User API Token (recommended) or locate the Global API Key
-- Grant the required read-only permissions (`Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`)
+- Grant the required read-only permissions (`Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`, `SSL and Certificates:Read`, `Bot Management:Read`, `Zone WAF:Read`)
 - Identify the Cloudflare Account ID to use as the provider identifier
 
 <Note>
 **Quick Setup:** Use these pre-configured links to create a token with the required permissions already selected:
 
-- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a User API Token (recommended).
-- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/), better suited for automation and CI/CD.
+- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a User API Token (recommended).
+- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/), better suited for automation and CI/CD.
 
-Both links open the Cloudflare Dashboard with the four required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the name `Prowler Security Scanner` prefilled. See [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication#api-token-recommended) for the equivalent manual steps.
+Both links open the Cloudflare Dashboard with the seven required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`, `SSL and Certificates`, `Bot Management`, `Zone WAF`) and the name `Prowler Security Scanner` prefilled. See [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication#api-token-recommended) for the equivalent manual steps.
 </Note>
 
 <CardGroup cols={2}>

docs/user-guide/providers/image/getting-started-image.mdx

@@ -97,6 +97,29 @@ Install Trivy using one of the following methods:
 
 For additional installation methods, see the [Trivy installation guide](https://trivy.dev/latest/getting-started/installation/).
 
+### Vulnerability Database Cache
+
+<VersionBadge version="5.42.0" />
+
+Trivy keeps its vulnerability database in a cache directory. By default Prowler gives it a temporary one and removes it when the scan ends, so the database is downloaded again for every scan.
+
+Set `TRIVY_CACHE_DIR` to a directory that persists and the database is downloaded once and reused:
+
+```bash
+export TRIVY_CACHE_DIR="$HOME/.cache/trivy"
+prowler image --image <image>
+```
+
+Prowler never deletes a directory you supply. Trivy still creates and updates its cache and database files inside it.
+
+<Note>
+A host with no internet access needs a pre-populated vulnerability database in a persistent directory, with `TRIVY_CACHE_DIR` pointing at it. Populate the directory on a machine that does have access and copy it across.
+
+Trivy tries to refresh the database when it considers it stale, and that download fails without network access. Set `TRIVY_SKIP_DB_UPDATE=true` (and `TRIVY_SKIP_JAVA_DB_UPDATE=true` if Java scanning is enabled) so it uses the supplied database as is.
+
+The database ages. A scan run against an old one reports only the vulnerabilities known when it was built, and nothing in the output says so, so keep track of when it was last refreshed.
+</Note>
+
 
 ### Supported Scanners
 
@@ -307,9 +330,21 @@ prowler image --registry internal-registry.local --registry-insecure
 ```
 
 <Warning>
-Skipping TLS verification disables certificate validation for registry connections. Use this flag only for trusted internal registries with self-signed certificates.
+Skipping TLS verification disables certificate validation for registry connections, including the Trivy image pull (`TRIVY_INSECURE`). Use this flag only for trusted internal registries with self-signed certificates.
 </Warning>
 
+#### On-Premises Registries and Private Networks
+
+<VersionBadge version="5.41.0" />
+
+By default, Prowler rejects registry-provided URLs (token endpoints, pagination links) that resolve to non-public addresses, as an SSRF defense. On-premises registries live on private networks by definition, so to scan them declare the trusted ranges explicitly:
+
+```bash
+export PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS="192.168.65.254/32,10.20.0.0/16"
+```
+
+The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (`169.254.169.254`), loopback, and the rest of the internal network remain protected. The variable applies to registry enumeration and to the connection test. Malformed entries fail at startup, and a non-empty allowlist is logged as a relaxed security control. When unset, behavior is unchanged: only public addresses are followed.
+
 #### Supported Registries
 
 Registry Scan Mode supports the following registry types:

docs/user-guide/providers/mongodbatlas/getting-started-mongodbatlas.mdx

@@ -37,7 +37,7 @@ If **Require IP Access List for the Atlas Administration API** is enabled in the
 
 <VersionBadge version="5.15.0" />
 
-### Step 1: Add the provider
+### Step 1: Add the Provider
 
 1. Navigate to **Providers** and click **Add Provider**.
    ![Add provider list](./img/add-provider-list.png)
@@ -46,13 +46,13 @@ If **Require IP Access List for the Atlas Administration API** is enabled in the
    ![Add organization ID](./img/add-org-id.png)
 4. (Optional) Add a friendly alias to identify this organization in dashboards.
 
-### Step 2: Provide API credentials
+### Step 2: Provide API Credentials
 
 1. Click **Next** to open the credentials form.
 2. Paste the **Atlas Public Key** and **Atlas Private Key** generated in the Atlas console.
    ![Add credentials](./img/add-credentials.png)
 
-### Step 3: Test the connection and start scanning
+### Step 3: Test the Connection and Start Scanning
 
 1. Click **Test connection** to ensure Prowler Cloud can reach the Atlas API.
 2. Save the credentials. The provider will appear in the list with its current connection status.
@@ -67,11 +67,11 @@ If **Require IP Access List for the Atlas Administration API** is enabled in the
 
 You can also run MongoDB Atlas assessments directly from the CLI. Both command-line flags and environment variables are supported.
 
-### Step 1: Select an authentication method
+### Step 1: Select an Authentication Method
 
 Choose one of the following authentication methods:
 
-#### Command-line arguments
+#### Command-Line Arguments
 
 ```bash
 prowler mongodbatlas \
@@ -79,7 +79,7 @@ prowler mongodbatlas \
   --atlas-private-key <private_key>
 ```
 
-#### Environment variables
+#### Environment Variables
 
 ```bash
 export ATLAS_PUBLIC_KEY=<public_key>
@@ -87,9 +87,9 @@ export ATLAS_PRIVATE_KEY=<private_key>
 prowler mongodbatlas
 ```
 
-### Step 2: Run the first scan
+### Step 2: Run the First Scan
 
-#### Scan all projects and clusters
+#### Scan All Projects and Clusters
 
 ```bash
 prowler mongodbatlas
@@ -97,7 +97,7 @@ prowler mongodbatlas
 
 This command enumerates all projects accessible to the API key and scans every cluster.
 
-#### Scan a specific project
+#### Scan a Specific Project
 
 Add the `--atlas-project-id` flag when you only want to assess one project:
 
@@ -105,7 +105,7 @@ Add the `--atlas-project-id` flag when you only want to assess one project:
 prowler mongodbatlas --atlas-project-id <project-id>
 ```
 
-### Additional tips
+### Additional Tips
 
 - Combine flags (for example, `--checks` or `--services`) just like with other providers.
 - Use `--output-modes` to export findings in JSON, CSV, ASFF, etc.

docs/user-guide/providers/okta/authentication.mdx

@@ -68,7 +68,7 @@ The service application must be assigned **one** of the following Okta admin rol
 
 Okta's Management API enforces a two-layer authorization model: an OAuth **scope** decides which API endpoints the token can call, and an **admin role** decides whether the call returns data. With only a scope granted, the token mint succeeds but every read returns `403 Forbidden`. Read-Only Administrator is the minimum role that lets the granted `okta.*.read` scopes return configuration data to Prowler's checks; without it, the credential probe at provider startup fails and the scan never gets to evaluate any check.
 
-#### When Super Administrator is required
+#### When Super Administrator Is Required
 
 Four checks need to resolve the Authentication Policy bound to Okta's first-party apps (Okta Admin Console, Okta Dashboard) and depend on `/api/v1/apps` returning those system apps — which Okta restricts to Super Administrator:
 
@@ -93,17 +93,17 @@ Read-Only Administrator stays the recommended default for the least-privilege fr
 
 ## Step-by-Step Setup
 
-### 1. Go to the admin console
+### 1. Go to the Admin Console
 
 ![Okta — admin console page](/user-guide/providers/okta/images/select-admin-console.png)
 
-### 2. [Optional] - Disable the privilege-escalation bypass (org-wide, one-time)
+### 2. [Optional] - Disable the Privilege-Escalation Bypass (Org-Wide, One-Time)
 
 In the Okta Admin Console, go to **Settings → Account → Public client app admins** and ensure it is **off**. When enabled, every API Services app can be auto-assigned the Super Administrator role after scopes are granted, which would invalidate the read-only premise of this integration.
 
 ![Okta — disable Public client app admins](/user-guide/providers/okta/images/public-client-app-admins.png)
 
-### 3. Create the API Services app
+### 3. Create the API Services App
 
 1. Go to **Applications → Applications**.
 
@@ -119,7 +119,7 @@ In the Okta Admin Console, go to **Settings → Account → Public client app ad
 
 ![Okta — copy client id](/user-guide/providers/okta/images/copy-client-id.png)
 
-### 4. Switch to private-key authentication and generate a keypair
+### 4. Switch to Private-Key Authentication and Generate a Keypair
 
 On the new app's **General** tab, scroll to **Client Credentials**:
 
@@ -137,13 +137,13 @@ Okta displays the private key **only once**. If you close the modal without copy
 
 ![Okta — create Public Key](/user-guide/providers/okta/images/create-public-key.png)
 
-### 5. Grant the required OAuth scopes
+### 5. Grant the Required OAuth Scopes
 
 On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`.
 
 ![Okta — grant OAuth scopes](/user-guide/providers/okta/images/grant-permissions.png)
 
-### 6. Assign an admin role
+### 6. Assign an Admin Role
 
 On the app, open the **Admin roles** tab and click **Edit assignments → Add assignment**:
 
@@ -156,7 +156,7 @@ To additionally evaluate the first-party application checks (Okta Admin Console
 
 ![Okta — grant Read-Only role](/user-guide/providers/okta/images/grant-roles.png)
 
-### 7. [Optional] Verify DPoP setting
+### 7. [Optional] Verify DPoP Setting
 
 Prowler sends DPoP (Demonstrating Proof of Possession) proofs on every token request. The integration works whether the **Require Demonstrating Proof of Possession (DPoP) header in token requests** setting on the service app is on or off — but enabling it is the more secure default.
 
@@ -207,20 +207,20 @@ The org domain must be `<org>.okta.com` (or `.oktapreview.com` / `.okta-emea.com
 
 The file at `OKTA_PRIVATE_KEY_FILE` is missing, unreadable, or empty. Confirm the path and that the file contains a non-empty PEM block or JWK JSON document.
 
-### `OktaInvalidCredentialsError` at provider init
+### `OktaInvalidCredentialsError` at Provider Init
 
 Prowler validates credentials at startup by listing one sign-on policy. This error indicates the credential material itself was rejected:
 
 - **`invalid_client`** — the public key registered in Okta does not match the private key on disk. Generate a fresh keypair and try again.
 
-### `OktaInsufficientPermissionsError` at provider init
+### `OktaInsufficientPermissionsError` at Provider Init
 
 Raised when the credential probe succeeds at the OAuth layer but the request is rejected because the service app lacks the required scope or admin role:
 
 - **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
 - **`Forbidden` / `not authorized`** — no admin role is assigned to the service app. Assign **Read-Only Administrator** (or **Super Administrator** for the first-party application checks) from **Admin roles**.
 
-### Application-service checks return MANUAL on first-party apps
+### Application-Service Checks Return MANUAL on First-Party Apps
 
 When the service app runs with Read-Only Administrator, the five application-service checks targeting the Okta Admin Console and Okta Dashboard return MANUAL. This is by design — Okta restricts the underlying endpoints (`/api/v1/first-party-app-settings/{appName}` and `/api/v1/apps` for first-party app `name` values `saasure` / `okta_enduser`) to **Super Administrator**. Assign the Super Administrator role to the service app to evaluate those checks. See [Required Admin Role](#required-admin-role) for the full list.
 

docs/user-guide/tutorials/prowler-app-findings-triage.mdx

@@ -140,18 +140,18 @@ Muting a finding does not fix the underlying configuration. Review the finding b
 
 ## Troubleshooting
 
-### Triage controls do not appear
+### Triage Controls Do Not Appear
 
 Make sure the row is an individual finding row. Finding Groups rows do not show triage controls. Expand a group to see affected resources and their triage controls.
 
-### Changes cannot be saved
+### Changes Cannot Be Saved
 
 Confirm that the user role has **Manage Scans** permission. Prowler Local Server does not support Findings Triage writes.
 
-### Resolved or Reopened is missing from the selector
+### Resolved or Reopened Is Missing from the Selector
 
 **Reopened** is always automatic. **Resolved** is set automatically from scan result changes and appears as a selector option only on `MANUAL` findings, where it records a [Manual Pass](#verify-a-manual-finding-as-pass). On findings with any other status, this is expected.
 
-### Risk Accepted or False Positive muted a finding
+### Risk Accepted or False Positive Muted a Finding
 
 This is expected. Those statuses create a mute rule through Mutelist.

docs/user-guide/tutorials/prowler-app-github-action.mdx

@@ -28,7 +28,7 @@ Source: [`prowler-cloud/prowler`](https://github.com/prowler-cloud/prowler) · M
 
 ## Usage
 
-### AWS scan
+### AWS Scan
 
 ```yaml
 - uses: prowler-cloud/prowler@5.25
@@ -41,7 +41,7 @@ Source: [`prowler-cloud/prowler`](https://github.com/prowler-cloud/prowler) · M
     AWS_SESSION_TOKEN: ${{ secrets.AWS_SESSION_TOKEN }}
 ```
 
-### Push findings to Prowler Cloud
+### Push Findings to Prowler Cloud
 
 Send scan results directly to [Prowler Cloud](/user-guide/tutorials/prowler-import-findings) for centralized visibility, compliance tracking, and team collaboration.
 
@@ -97,7 +97,7 @@ jobs:
 - GitHub Code Scanning is free for public repositories. Private repositories require a [GitHub Code Security](https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security) license.
 </Warning>
 
-### Combine push-to-cloud with SARIF upload
+### Combine Push-to-Cloud with SARIF Upload
 
 ```yaml
 - uses: prowler-cloud/prowler@5.25
@@ -114,7 +114,7 @@ jobs:
     PROWLER_CLOUD_API_KEY: ${{ secrets.PROWLER_CLOUD_API_KEY }}
 ```
 
-### Scan the current repository with the GitHub provider
+### Scan the Current Repository with the GitHub Provider
 
 ```yaml
 name: Prowler GitHub Scan
@@ -142,7 +142,7 @@ jobs:
 `--repository` scans a single repo. Use `--organization <name>` instead to include org-level checks (MFA, security policies, etc.). See the [GitHub provider authentication](/user-guide/providers/github/authentication) for required token permissions.
 </Info>
 
-### Fail the PR on findings
+### Fail the PR on Findings
 
 By default the action tolerates findings (exit code 3) and succeeds. Set `fail-on-findings: true` to fail the workflow step when Prowler detects findings. Combine with `--severity` to control which severity levels trigger the failure:
 
@@ -241,7 +241,7 @@ steps:
 
 ### Cloudflare
 
-Create a Cloudflare API Token with `Zone:Read`, `Zone Settings:Read`, and `DNS:Read` permissions ([provider auth docs](/user-guide/providers/cloudflare/authentication)). Then:
+Create a Cloudflare API Token with the `Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`, `SSL and Certificates:Read`, `Bot Management:Read`, and `Zone WAF:Read` permissions ([provider auth docs](/user-guide/providers/cloudflare/authentication)). Then:
 
 ```yaml
 - uses: prowler-cloud/prowler@5.25
@@ -258,7 +258,7 @@ Scan results are written to `output/` in the workspace and uploaded as artifacts
 
 When `upload-sarif` is enabled, SARIF results are also uploaded to GitHub Code Scanning and appear on the repository's **Security → Code scanning** tab, filtered by the branch that ran the scan.
 
-### Step summary
+### Step Summary
 
 The action writes a summary to the run page with a per-severity breakdown of failing checks, artifact and Code Scanning links, and (when `push-to-cloud: false`) a pointer to [Prowler Cloud](https://cloud.prowler.com) for continuous monitoring.
 

docs/user-guide/tutorials/prowler-app-jira-integration.mdx

@@ -124,6 +124,18 @@ To manually send individual Findings to Jira:
 
     ![Send to Jira modal](/images/prowler-app/jira/send-to-jira-modal.png)
 
+### Finding Reference in the Jira Issue
+
+<VersionBadge version="5.41.0" />
+
+Every Jira issue created from a single Finding carries a stable reference back to that Finding, so issues can be filtered, searched with Jira Query Language (JQL), or matched by automation:
+
+* **Labels**: `prowler`, `prowler-<provider>`, `prowler-<severity>`, `prowler-<check-id>` and `prowler-finding-<finding-uid>`. Labels are sanitized deterministically: whitespace becomes `_`, control characters are removed, and values are truncated to Jira's 255-character label limit.
+* **Finding URL**: a link that opens the Finding in Prowler, filtered by its unique identifier (UID) so it keeps working after later scans.
+* **Tenant Info**: the name of the Prowler organization that sent the Finding.
+
+Prowler Cloud always includes the Finding URL. In Prowler Local Server, set `DJANGO_UI_BASE_URL` in the API environment (for example, `https://prowler.example.com`) to enable it. When the variable is empty, the issue is created without the link.
+
 ## Integration Status
 
 Monitor and manage your Jira integrations through the management interface:
@@ -159,13 +171,13 @@ Support for custom field mapping is planned for a future release.
 
 ## Troubleshooting
 
-### Connection test fails
+### Connection Test Fails
 
 * Verify Jira instance domain is correct and accessible
 * Confirm API token or credentials are valid
 * Ensure API access is enabled in Jira settings and the needed scopes are granted
 
-### Check task status (API)
+### Check Task Status (API)
 
 If the Jira issue does not appear in your Jira project, follow these steps to verify the export task status via the API.
 

docs/user-guide/tutorials/prowler-app-rbac.mdx

@@ -257,11 +257,11 @@ The **Scope** column indicates where each permission applies. **All** means the
 </Note>
 To grant all administrative permissions, select the **Grant all admin permissions** option.
 
-### Prowler Cloud exclusive permissions
+### Prowler Cloud Exclusive Permissions
 
 The following permissions are available exclusively in **Prowler Cloud**:
 
-**Manage Ingestions:** Submit and manage findings ingestion jobs via the API. Required to upload OCSF scan results using the `--push-to-cloud` CLI flag or the ingestion endpoints. See [Import Findings](/user-guide/tutorials/prowler-import-findings) for details.
+**Manage Ingestions:** Submit and manage findings ingestion jobs. Required to upload OCSF scan results from the Scans page, with the `--push-to-cloud` CLI flag or through the ingestion endpoints. See [Import Findings](/user-guide/tutorials/prowler-import-findings) for details.
 
 **Manage Billing:** Access and manage billing settings, subscription plans, and payment methods.
 

docs/user-guide/tutorials/prowler-app-slack-integration.mdx

@@ -58,12 +58,14 @@ Two of these read more broadly than they behave, and both are worth understandin
 
 On the consent screen, `chat:write.public` reads as permission to post in any public channel. Prowler never uses it that way: **Prowler only ever posts to the channels authorized on the integration.** The scope exists so that authorizing a public channel does not also require someone to invite the Prowler app to it first.
 
+{/* The Prowler UI deep-links to this heading's anchor, so rewording the heading breaks that link. */}
+
 ### Why a Private Channel Is Missing From the Channel List
 
-`groups:read` reveals only the private channels the Prowler app is already a member of. A private channel therefore appears in the channel list only after someone invites `@Prowler` to it in Slack:
+`groups:read` reveals only the private channels the Prowler app is already a member of. A private channel therefore appears in the channel list only after someone invites `@Prowler Cloud` to it in Slack:
 
 ```text
-/invite @Prowler
+/invite @Prowler Cloud
 ```
 
 That invite is issued in Slack, by that channel's own members, and **the invite itself is the permission grant** — no scope bypasses it. Prowler ships no in-product flow to get the app invited, because the decision belongs to the channel's members. After inviting the app, click **Refresh channels** to re-read the list.
@@ -100,14 +102,14 @@ Prowler posts to the channels authorized on the integration. Several channels ca
 
     ![Destination channels selection listing public channels and an invited private channel marked Private](/images/prowler-app/slack/channel-picker.png)
 
-2. Select one or more channels. A selected private channel keeps its lock and **Private** identification with the list closed, so the authorized set stays readable at a glance.
+2. Select one or more channels. A selected private channel keeps the same **Private** marking with the list closed, so the authorized set stays readable at a glance.
 3. Click **Save channels**.
 
 Prowler validates the selection against Slack and derives each channel name itself, so a recorded name can never drift from the channel it belongs to. Once the set is saved, the page reports where Prowler posts and runs the connection check over it.
 
-If the selection reports that no channels are available, the workspace exposes nothing Prowler can see. Create a public channel, or invite `@Prowler` to a private one, then click **Refresh channels**.
+If the selection reports that no channels are available, the workspace exposes nothing Prowler can see. Create a public channel, or invite `@Prowler Cloud` to a private one, then click **Refresh channels**.
 
-A workspace can hold more channels than Prowler reads in one go. When that happens, the selection says so and lists what was read: every listed channel is usable, and a channel missing from a partial list is not necessarily one `@Prowler` has to be invited to. Only listed channels can be selected: **Refresh channels** repeats the same bounded read rather than reading further, and the selection's search filters what was already read, so neither surfaces a channel the read left out.
+A workspace can hold more channels than Prowler reads in one go. When that happens, the selection says so and lists what was read: every listed channel is usable, and a channel missing from a partial list is not necessarily one `@Prowler Cloud` has to be invited to. Only listed channels can be selected: **Refresh channels** repeats the same bounded read rather than reading further, and the selection's search filters what was already read, so neither surfaces a channel the read left out.
 
 Saving a new selection replaces the authorized set: channels left out of it stop being authorized, and channels added to it are authorized but not yet confirmed. Changing which channels are in the set also resets the integration's connection state, so the check runs again over the new set — reordering the same channels does not. Saving an empty selection leaves the integration with no authorized channels, and **Test connection** cannot be run again until at least one channel is authorized.
 
@@ -159,7 +161,7 @@ The Slack management page reports the state of the connection and offers these a
 | Button | Purpose | Notes |
 |--------|---------|-------|
 | **Test connection** | Verify the credential and every authorized channel, and confirm the ones not confirmed yet | Posts the confirmation message once per channel and updates the last-checked time. Cannot be run until at least one channel is authorized |
-| **Refresh channels** | Re-read the workspace's channel list | Use after inviting `@Prowler` to a private channel |
+| **Refresh channels** | Re-read the workspace's channel list | Use after inviting `@Prowler Cloud` to a private channel |
 | **Save channels** | Record the selected channels as the integration's authorized set | Enabled once the selection differs from the authorized set |
 | **Disconnect** | Remove the integration and attempt to revoke access at Slack | ⚠️ **Cannot be undone** — confirm before disconnecting |
 
@@ -171,7 +173,7 @@ The Prowler Slack app is not configured for the deployment being used, so no wor
 
 ### A Private Channel Does Not Appear in the Channel List
 
-The Prowler app has not been invited to it. In Slack, run `/invite @Prowler` in that channel, then click **Refresh channels**. Membership is the permission: no scope reveals a private channel the app is not in.
+The Prowler app has not been invited to it. In Slack, run `/invite @Prowler Cloud` in that channel, then click **Refresh channels**. Membership is the permission: no scope reveals a private channel the app is not in.
 
 ### Connection Test Fails
 

docs/user-guide/tutorials/prowler-app.mdx

@@ -166,6 +166,6 @@ Once your scan has finished, you don’t need to grab the entire ZIP—just pull
 <Note>
 **API Note**
 
-To fetch a single compliance report via API, see the Retrieve compliance report as CSV endpoint in the Prowler API Reference.[Prowler API Reference - Retrieve compliance report as CSV](https://api.prowler.com/api/v1/docs#tag/Scan/operation/scans_compliance_retrieve)
+To fetch a single compliance report via API, see the Retrieve compliance report as CSV endpoint in the Prowler API Reference. [Prowler API Reference - Retrieve compliance report as CSV](https://api.prowler.com/api/v1/docs#tag/Scan/operation/scans_compliance_retrieve)
 
 </Note>

docs/user-guide/tutorials/prowler-import-findings.mdx

@@ -8,7 +8,7 @@ import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
 
 <VersionBadge version="5.19.0" />
 
-Findings Ingestion enables uploading OCSF (Open Cybersecurity Schema Framework) scan results to Prowler Cloud. This feature supports importing findings from Prowler CLI output files that use the [Detection Finding](https://schema.ocsf.io/classes/detection_finding) class.
+Findings Ingestion enables uploading OCSF (Open Cybersecurity Schema Framework) scan results to Prowler Cloud. This feature supports importing findings from Prowler CLI output files that use the [Detection Finding](https://schema.ocsf.io/classes/detection_finding) class. Reports can be imported from the Scans page in the Prowler Cloud UI, pushed by the CLI with `--push-to-cloud`, or submitted through the API.
 
 <SubscriptionBanner />
 
@@ -131,10 +131,32 @@ Only **Detection Finding** (`class_uid: 2004`) records are accepted. Other OCSF
 
 ## Required Permissions
 
-The **Manage Ingestions** RBAC permission controls access to the ingestion endpoints. Without this permission, findings cannot be submitted via the API or `--push-to-cloud`.
+The **Manage Ingestions** RBAC permission controls access to the ingestion endpoints. Without this permission, findings cannot be submitted from the Scans page, via the API or with `--push-to-cloud`.
 
 For more information about RBAC permissions, refer to the [Prowler Cloud RBAC documentation](/user-guide/tutorials/prowler-app-rbac).
 
+## Using the UI
+
+<VersionBadge version="5.41.0" />
+
+The Scans page imports a Prowler OCSF report from the browser, with no CLI or API key involved. The import runs as a regular ingestion job, so the [status values](#ingestion-status-values), the [billing impact](#billing-impact) and the [errors endpoint](#get-ingestion-errors) apply as they do for the CLI and the API.
+
+1. Go to **Scans** and click **Import Findings**. The button is shown only to roles with the **Manage Ingestions** permission.
+
+    ![Import Findings button on the Scans page](/images/prowler-app/import-findings/import-findings-button.png)
+
+2. Drag a `.ocsf.json` report onto the drop area, or click **Select File** to pick one. The dialog takes one file per import. A file whose name does not end in `.ocsf.json`, or an empty file, is rejected before the upload starts.
+
+    ![Import findings dialog with the drag-and-drop area](/images/prowler-app/import-findings/import-findings-dialog.png)
+
+3. Click **Start import**. The dialog uploads the report, creates the ingestion job and follows its status until the job finishes. On completion it reports the total number of records, how many were processed and how many were invalid.
+
+Closing the dialog while an import is running does not cancel the job. When the job completes in the background, a notification confirms it and the imported findings appear in Scans.
+
+If the upload is rejected or the job fails, the dialog shows the reason and a **Retry import** button that sends the same file again. A failed job also shows the progress it reported before failing. A different file can be selected instead of retrying. If the status check fails after the upload was accepted, **Retry status** resumes tracking the same job without uploading the file again.
+
+Invalid records are counted in the summary but not listed in the dialog. To see why each one was rejected, [list the ingestion jobs](#list-ingestion-jobs) through the API and query the [errors endpoint](#get-ingestion-errors) for that job.
+
 ## Using the CLI
 
 The `--push-to-cloud` flag uploads scan results directly to Prowler Cloud after a scan completes. This approach automates the ingestion process without manual file uploads.
@@ -443,7 +465,7 @@ For pricing details, see [Prowler Cloud Pricing](https://prowler.com/pricing).
 - The user associated with the API key lacks the **Manage Ingestions** permission
 - Contact the tenant administrator to grant the required permission
 
-### Ingestion job status is "failed"
+### Ingestion Job Status Is "failed"
 
 - Check the `/api/v1/ingestions/{id}/errors` endpoint for details
 - Verify the OCSF file format is valid