ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-25 04:44:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge master

Browse Source
This commit is contained in:
mintlify[bot] authored and GitHub committed 2026-09-21 07:11:40 +00:00
2 parents 2d4ab4cc25 03cb59c20d
commit c453b7293e
768 files changed
+62058 -7161
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/user-guide/cli/tutorials/configuration_file.mdx
+11
View File
@@ -52,6 +52,7 @@ The following list includes all the AWS checks with configurable variables that
| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_actions` | List of Strings | See `config.yaml` |
| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_minutes` | Integer | `1440` |
| `cloudtrail_threat_detection_privilege_escalation` | `threat_detection_privilege_escalation_threshold` | Float | `0.2` |
| `cloudwatch_log_group_agentcore_data_protection_policy_enabled` | `agentcore_log_group_name_prefixes` | List of Strings | See `config.yaml` |
| `cloudwatch_log_group_no_secrets_in_logs` | `secrets_ignore_patterns` | List of Strings | `[]` |
| `cloudwatch_log_group_retention_policy_specific_days_enabled` | `log_group_retention_days` | Integer | `365` |
| `codebuild_project_no_secrets_in_variables` | `excluded_sensitive_environment_variables` | List of Strings | `[]` |
@@ -91,6 +92,8 @@ The following list includes all the AWS checks with configurable variables that
| `iam_user_access_not_stale_to_sagemaker` | `max_unused_sagemaker_access_days` | Integer | `90` |
| `iam_user_accesskey_unused` | `max_unused_access_keys_days` | Integer | `45` |
| `iam_user_console_access_unused` | `max_console_access_days` | Integer | `45` |
| `inspector2_active_findings_within_max_age` | `inspector2_active_finding_max_age_days` | Integer | `192` |
| `inspector2_coverage_recently_scanned` | `inspector2_max_days_since_last_scan` | Integer | `3` |
| `kinesis_stream_data_retention_period` | `min_kinesis_stream_retention_hours` | Integer | `168` |
| `neptune_cluster_backup_enabled` | `minimum_backup_retention_period` | Integer | `7` |
| `opensearch_service_domains_not_publicly_accessible` | `trusted_ips` | List of Strings | `[]` |
@@ -490,6 +493,14 @@ aws:
# MEDIUM
ecr_repository_vulnerability_minimum_severity: "MEDIUM"
# AWS Inspector2
# aws.inspector2_coverage_recently_scanned
# Maximum days since Inspector2 last scanned an actively covered resource
inspector2_max_days_since_last_scan: 3
# aws.inspector2_active_findings_within_max_age
# Maximum days an Inspector2 finding can stay active since it was first observed
inspector2_active_finding_max_age_days: 192
# AWS Trusted Advisor
# aws.trustedadvisor_premium_support_plan_subscribed
verify_premium_support_plans: True
docs/user-guide/cli/tutorials/fixer.mdx
+1 -1
View File
@@ -106,7 +106,7 @@ def fixer(resource_id: str) -> bool:
return True
```
## Fixer Config file
## Fixer Config File
For some fixers, you can have configurable parameters depending on your use case. You can either use the default config file in `prowler/config/fixer_config.yaml` or create a custom config file and pass it to the fixer with the `--fixer-config` flag. The config file should be a YAML file with the following structure:
docs/user-guide/cli/tutorials/misc.mdx
+2 -2
View File
@@ -5,7 +5,7 @@ description: 'Show Prowler version, enable verbose mode, tune execution behavior
## Prowler Version
### Showing the Prowler version:
### Showing the Prowler Version
```console
prowler <provider> -V/-v/--version
@@ -23,7 +23,7 @@ To enable verbose mode in Prowler, similar to Version 2, use:
prowler <provider> --verbose
```
### Filter findings by status
### Filter Findings by Status
Prowler allows filtering findings based on their status, ensuring reports and CLI display only relevant findings:
docs/user-guide/cli/tutorials/mutelist.mdx
+1 -1
View File
@@ -269,7 +269,7 @@ Accounts:
## AWS Mutelist
### Muting specific AWS regions
### Muting Specific AWS Regions
If you want to mute failed findings only in specific regions, create a file with the following syntax and run it with `prowler aws -w mutelist.yaml`:
docs/user-guide/cli/tutorials/pentesting.mdx
+1 -4
View File
@@ -44,8 +44,7 @@ prowler <provider> --categories secrets
Several checks analyse resources that are exposed to the Internet, these are:
1. apigateway\_restapi\_public
- apigateway\_restapi\_public
- appstream\_fleet\_default\_internet\_access\_disabled
- awslambda\_function\_not\_publicly\_accessible
- ec2\_ami\_public
@@ -59,8 +58,6 @@ Several checks analyse resources that are exposed to the Internet, these are:
- ecr\_repositories\_not\_publicly\_accessible
- eks\_control\_plane\_endpoint\_access\_restricted
- eks\_endpoints\_not\_publicly\_accessible
- eks\_control\_plane\_endpoint\_access\_restricted
- eks\_endpoints\_not\_publicly\_accessible
- elbv2\_internet\_facing
- kms\_key\_not\_publicly\_accessible
- opensearch\_service\_domains\_not\_publicly\_accessible