feat(skills): sync AGENTS.md to AI-specific formats (#9751)

Co-authored-by: Alan-TheGentleman <alan@thegentleman.dev> Co-authored-by: pedrooot <pedromarting3@gmail.com> Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com>
2026-01-25 02:08:11 +00:00 · 2026-01-13 11:44:44 +01:00
parent b0eea61468
commit c8fab497fd
56 changed files with 3714 additions and 184 deletions
--- a/skills/prowler-compliance/SKILL.md
+++ b/skills/prowler-compliance/SKILL.md
@@ -2,11 +2,15 @@
 name: prowler-compliance
 description: >
  Creates and manages Prowler compliance frameworks.
-  Trigger: When working with compliance frameworks (CIS, NIST, PCI-DSS, SOC2, GDPR).
+  Trigger: When working with compliance frameworks (CIS, NIST, PCI-DSS, SOC2, GDPR, ISO27001, ENS, MITRE ATT&CK).
 license: Apache-2.0
 metadata:
  author: prowler-cloud
-  version: "1.0"
+  version: "1.1"
+  scope: [root, sdk]
+  auto_invoke:
+    - "Creating/updating compliance frameworks"
+    - "Mapping checks to compliance controls"
 allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task
 ---

@@ -16,98 +20,472 @@ Use this skill when:
 - Creating a new compliance framework for any provider
 - Adding requirements to existing frameworks
 - Mapping checks to compliance controls
+- Understanding compliance framework structures and attributes

-## Compliance Framework Structure
+## Compliance Framework Location

-Frameworks are JSON files in: `prowler/compliance/{provider}/{framework}.json`
+Frameworks are JSON files located in: `prowler/compliance/{provider}/{framework_name}_{provider}.json`
+
+**Supported Providers:**
+- `aws` - Amazon Web Services
+- `azure` - Microsoft Azure
+- `gcp` - Google Cloud Platform
+- `kubernetes` - Kubernetes
+- `github` - GitHub
+- `m365` - Microsoft 365
+- `alibabacloud` - Alibaba Cloud
+- `oraclecloud` - Oracle Cloud
+- `oci` - Oracle Cloud Infrastructure
+- `nhn` - NHN Cloud
+- `mongodbatlas` - MongoDB Atlas
+- `iac` - Infrastructure as Code
+- `llm` - Large Language Models
+
+## Base Framework Structure
+
+All compliance frameworks share this base structure:

 ```json
 {
-  "Framework": "CIS",
-  "Name": "CIS Amazon Web Services Foundations Benchmark v2.0.0",
-  "Version": "2.0",
-  "Provider": "AWS",
-  "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance...",
+  "Framework": "FRAMEWORK_NAME",
+  "Name": "Full Framework Name with Version",
+  "Version": "X.X",
+  "Provider": "PROVIDER",
+  "Description": "Framework description...",
  "Requirements": [
    {
-      "Id": "1.1",
-      "Name": "Requirement name",
-      "Description": "Detailed description of the requirement",
-      "Attributes": [
-        {
-          "Section": "1. Identity and Access Management",
-          "Profile": "Level 1",
-          "AssessmentStatus": "Automated",
-          "Description": "Attribute description"
-        }
-      ],
+      "Id": "requirement_id",
+      "Description": "Requirement description",
+      "Name": "Optional requirement name",
+      "Attributes": [...],
      "Checks": ["check_name_1", "check_name_2"]
    }
  ]
 }
 ```

-## Supported Frameworks
+## Framework-Specific Attribute Structures

-**Industry standards:**
- CIS (Center for Internet Security)
- NIST 800-53, NIST CSF
- CISA
+Each framework type has its own attribute model. Below are the exact structures used by Prowler:

-**Regulatory compliance:**
- PCI-DSS
- HIPAA
- GDPR
- FedRAMP
- SOC2
+### CIS (Center for Internet Security)

-**Cloud-specific:**
- AWS Well-Architected Framework (Security Pillar)
- AWS Foundational Technical Review (FTR)
- Azure Security Benchmark
- GCP Security Best Practices
-
-## Framework Requirement Mapping
-
-Each requirement maps to one or more checks:
+**Framework ID format:** `cis_{version}_{provider}` (e.g., `cis_5.0_aws`)

 ```json
 {
-  "Id": "2.1.1",
-  "Name": "Ensure MFA is enabled for all IAM users",
-  "Description": "Multi-Factor Authentication adds an extra layer of protection...",
-  "Checks": [
-    "iam_user_mfa_enabled",
-    "iam_root_mfa_enabled",
-    "iam_user_hardware_mfa_enabled"
+  "Id": "1.1",
+  "Description": "Maintain current contact details",
+  "Checks": ["account_maintain_current_contact_details"],
+  "Attributes": [
+    {
+      "Section": "1 Identity and Access Management",
+      "SubSection": "Optional subsection",
+      "Profile": "Level 1",
+      "AssessmentStatus": "Automated",
+      "Description": "Detailed attribute description",
+      "RationaleStatement": "Why this control matters",
+      "ImpactStatement": "Impact of implementing this control",
+      "RemediationProcedure": "Steps to fix the issue",
+      "AuditProcedure": "Steps to verify compliance",
+      "AdditionalInformation": "Extra notes",
+      "DefaultValue": "Default configuration value",
+      "References": "https://docs.example.com/reference"
+    }
  ]
 }
 ```

+**Profile values:** `Level 1`, `Level 2`, `E3 Level 1`, `E3 Level 2`, `E5 Level 1`, `E5 Level 2`
+**AssessmentStatus values:** `Automated`, `Manual`
+
+---
+
+### ISO 27001
+
+**Framework ID format:** `iso27001_{year}_{provider}` (e.g., `iso27001_2022_aws`)
+
+```json
+{
+  "Id": "A.5.1",
+  "Description": "Policies for information security should be defined...",
+  "Name": "Policies for information security",
+  "Checks": ["securityhub_enabled"],
+  "Attributes": [
+    {
+      "Category": "A.5 Organizational controls",
+      "Objetive_ID": "A.5.1",
+      "Objetive_Name": "Policies for information security",
+      "Check_Summary": "Summary of what is being checked"
+    }
+  ]
+}
+```
+
+**Note:** `Objetive_ID` and `Objetive_Name` use this exact spelling (not "Objective").
+
+---
+
+### ENS (Esquema Nacional de Seguridad - Spain)
+
+**Framework ID format:** `ens_rd2022_{provider}` (e.g., `ens_rd2022_aws`)
+
+```json
+{
+  "Id": "op.acc.1.aws.iam.2",
+  "Description": "Proveedor de identidad centralizado",
+  "Checks": ["iam_check_saml_providers_sts"],
+  "Attributes": [
+    {
+      "IdGrupoControl": "op.acc.1",
+      "Marco": "operacional",
+      "Categoria": "control de acceso",
+      "DescripcionControl": "Detailed control description in Spanish",
+      "Nivel": "alto",
+      "Tipo": "requisito",
+      "Dimensiones": ["trazabilidad", "autenticidad"],
+      "ModoEjecucion": "automatico",
+      "Dependencias": []
+    }
+  ]
+}
+```
+
+**Nivel values:** `opcional`, `bajo`, `medio`, `alto`
+**Tipo values:** `refuerzo`, `requisito`, `recomendacion`, `medida`
+**Dimensiones values:** `confidencialidad`, `integridad`, `trazabilidad`, `autenticidad`, `disponibilidad`
+
+---
+
+### MITRE ATT&CK
+
+**Framework ID format:** `mitre_attack_{provider}` (e.g., `mitre_attack_aws`)
+
+MITRE uses a different requirement structure:
+
+```json
+{
+  "Name": "Exploit Public-Facing Application",
+  "Id": "T1190",
+  "Tactics": ["Initial Access"],
+  "SubTechniques": [],
+  "Platforms": ["Containers", "IaaS", "Linux", "Network", "Windows", "macOS"],
+  "Description": "Adversaries may attempt to exploit a weakness...",
+  "TechniqueURL": "https://attack.mitre.org/techniques/T1190/",
+  "Checks": ["guardduty_is_enabled", "inspector2_is_enabled"],
+  "Attributes": [
+    {
+      "AWSService": "Amazon GuardDuty",
+      "Category": "Detect",
+      "Value": "Minimal",
+      "Comment": "Explanation of how this service helps..."
+    }
+  ]
+}
+```
+
+**For Azure:** Use `AzureService` instead of `AWSService`
+**For GCP:** Use `GCPService` instead of `AWSService`
+**Category values:** `Detect`, `Protect`, `Respond`
+**Value values:** `Minimal`, `Partial`, `Significant`
+
+---
+
+### NIST 800-53
+
+**Framework ID format:** `nist_800_53_revision_{version}_{provider}` (e.g., `nist_800_53_revision_5_aws`)
+
+```json
+{
+  "Id": "ac_2_1",
+  "Name": "AC-2(1) Automated System Account Management",
+  "Description": "Support the management of system accounts...",
+  "Checks": ["iam_password_policy_minimum_length_14"],
+  "Attributes": [
+    {
+      "ItemId": "ac_2_1",
+      "Section": "Access Control (AC)",
+      "SubSection": "Account Management (AC-2)",
+      "SubGroup": "AC-2(3) Disable Accounts",
+      "Service": "iam"
+    }
+  ]
+}
+```
+
+---
+
+### Generic Compliance (Fallback)
+
+For frameworks without specific attribute models:
+
+```json
+{
+  "Id": "requirement_id",
+  "Description": "Requirement description",
+  "Name": "Optional name",
+  "Checks": ["check_name"],
+  "Attributes": [
+    {
+      "ItemId": "item_id",
+      "Section": "Section name",
+      "SubSection": "Subsection name",
+      "SubGroup": "Subgroup name",
+      "Service": "service_name",
+      "Type": "type"
+    }
+  ]
+}
+```
+
+---
+
+### AWS Well-Architected Framework
+
+**Framework ID format:** `aws_well_architected_framework_{pillar}_pillar_aws`
+
+```json
+{
+  "Id": "SEC01-BP01",
+  "Description": "Establish common guardrails...",
+  "Name": "Establish common guardrails",
+  "Checks": ["account_part_of_organizations"],
+  "Attributes": [
+    {
+      "Name": "Establish common guardrails",
+      "WellArchitectedQuestionId": "securely-operate",
+      "WellArchitectedPracticeId": "sec_securely_operate_multi_accounts",
+      "Section": "Security",
+      "SubSection": "Security foundations",
+      "LevelOfRisk": "High",
+      "AssessmentMethod": "Automated",
+      "Description": "Detailed description",
+      "ImplementationGuidanceUrl": "https://docs.aws.amazon.com/..."
+    }
+  ]
+}
+```
+
+---
+
+### KISA ISMS-P (Korea)
+
+**Framework ID format:** `kisa_isms_p_{year}_{provider}` (e.g., `kisa_isms_p_2023_aws`)
+
+```json
+{
+  "Id": "1.1.1",
+  "Description": "Requirement description",
+  "Name": "Requirement name",
+  "Checks": ["check_name"],
+  "Attributes": [
+    {
+      "Domain": "1. Management System",
+      "Subdomain": "1.1 Management System Establishment",
+      "Section": "1.1.1 Section Name",
+      "AuditChecklist": ["Checklist item 1", "Checklist item 2"],
+      "RelatedRegulations": ["Regulation 1"],
+      "AuditEvidence": ["Evidence type 1"],
+      "NonComplianceCases": ["Non-compliance example"]
+    }
+  ]
+}
+```
+
+---
+
+### C5 (Germany Cloud Computing Compliance Criteria Catalogue)
+
+**Framework ID format:** `c5_{provider}` (e.g., `c5_aws`)
+
+```json
+{
+  "Id": "BCM-01",
+  "Description": "Requirement description",
+  "Name": "Requirement name",
+  "Checks": ["check_name"],
+  "Attributes": [
+    {
+      "Section": "BCM Business Continuity Management",
+      "SubSection": "BCM-01",
+      "Type": "Basic Criteria",
+      "AboutCriteria": "Description of criteria",
+      "ComplementaryCriteria": "Additional criteria"
+    }
+  ]
+}
+```
+
+---
+
+### CCC (Cloud Computing Compliance)
+
+**Framework ID format:** `ccc_{provider}` (e.g., `ccc_aws`)
+
+```json
+{
+  "Id": "CCC.C01",
+  "Description": "Requirement description",
+  "Name": "Requirement name",
+  "Checks": ["check_name"],
+  "Attributes": [
+    {
+      "FamilyName": "Cryptography & Key Management",
+      "FamilyDescription": "Family description",
+      "Section": "CCC.C01",
+      "SubSection": "Key Management",
+      "SubSectionObjective": "Objective description",
+      "Applicability": ["IaaS", "PaaS", "SaaS"],
+      "Recommendation": "Recommended action",
+      "SectionThreatMappings": [{"threat": "T1190"}],
+      "SectionGuidelineMappings": [{"guideline": "NIST"}]
+    }
+  ]
+}
+```
+
+---
+
+### Prowler ThreatScore
+
+**Framework ID format:** `prowler_threatscore_{provider}` (e.g., `prowler_threatscore_aws`)
+
+Prowler ThreatScore is a custom security scoring framework developed by Prowler that evaluates AWS account security based on **four main pillars**:
+
+| Pillar | Description |
+|--------|-------------|
+| **1. IAM** | Identity and Access Management controls (authentication, authorization, credentials) |
+| **2. Attack Surface** | Network exposure, public resources, security group rules |
+| **3. Logging and Monitoring** | Audit logging, threat detection, forensic readiness |
+| **4. Encryption** | Data at rest and in transit encryption |
+
+**Scoring System:**
+- **LevelOfRisk** (1-5): Severity of the security issue
+  - `5` = Critical (e.g., root MFA, public S3 buckets)
+  - `4` = High (e.g., user MFA, public EC2)
+  - `3` = Medium (e.g., password policies, encryption)
+  - `2` = Low
+  - `1` = Informational
+- **Weight**: Impact multiplier for score calculation
+  - `1000` = Critical controls (root security, public exposure)
+  - `100` = High-impact controls (user authentication, monitoring)
+  - `10` = Standard controls (password policies, encryption)
+  - `1` = Low-impact controls (best practices)
+
+```json
+{
+  "Id": "1.1.1",
+  "Description": "Ensure MFA is enabled for the 'root' user account",
+  "Checks": ["iam_root_mfa_enabled"],
+  "Attributes": [
+    {
+      "Title": "MFA enabled for 'root'",
+      "Section": "1. IAM",
+      "SubSection": "1.1 Authentication",
+      "AttributeDescription": "The root user account holds the highest level of privileges within an AWS account. Enabling MFA enhances security by adding an additional layer of protection.",
+      "AdditionalInformation": "Enabling MFA enhances console security by requiring the authenticating user to both possess a time-sensitive key-generating device and have knowledge of their credentials.",
+      "LevelOfRisk": 5,
+      "Weight": 1000
+    }
+  ]
+}
+```
+
+**Available for providers:** AWS, Kubernetes, M365
+
+---
+
+## Available Compliance Frameworks
+
+### AWS (41 frameworks)
+| Framework | File Name |
+|-----------|-----------|
+| CIS 1.4, 1.5, 2.0, 3.0, 4.0, 5.0 | `cis_{version}_aws.json` |
+| ISO 27001:2013, 2022 | `iso27001_{year}_aws.json` |
+| NIST 800-53 Rev 4, 5 | `nist_800_53_revision_{version}_aws.json` |
+| NIST 800-171 Rev 2 | `nist_800_171_revision_2_aws.json` |
+| NIST CSF 1.1, 2.0 | `nist_csf_{version}_aws.json` |
+| PCI DSS 3.2.1, 4.0 | `pci_{version}_aws.json` |
+| HIPAA | `hipaa_aws.json` |
+| GDPR | `gdpr_aws.json` |
+| SOC 2 | `soc2_aws.json` |
+| FedRAMP Low/Moderate | `fedramp_{level}_revision_4_aws.json` |
+| ENS RD2022 | `ens_rd2022_aws.json` |
+| MITRE ATT&CK | `mitre_attack_aws.json` |
+| C5 Germany | `c5_aws.json` |
+| CISA | `cisa_aws.json` |
+| FFIEC | `ffiec_aws.json` |
+| RBI Cyber Security | `rbi_cyber_security_framework_aws.json` |
+| AWS Well-Architected | `aws_well_architected_framework_{pillar}_pillar_aws.json` |
+| AWS FTR | `aws_foundational_technical_review_aws.json` |
+| GxP 21 CFR Part 11, EU Annex 11 | `gxp_{standard}_aws.json` |
+| KISA ISMS-P 2023 | `kisa_isms_p_2023_aws.json` |
+| NIS2 | `nis2_aws.json` |
+
+### Azure (15+ frameworks)
+| Framework | File Name |
+|-----------|-----------|
+| CIS 2.0, 2.1, 3.0, 4.0 | `cis_{version}_azure.json` |
+| ISO 27001:2022 | `iso27001_2022_azure.json` |
+| ENS RD2022 | `ens_rd2022_azure.json` |
+| MITRE ATT&CK | `mitre_attack_azure.json` |
+| PCI DSS 4.0 | `pci_4.0_azure.json` |
+| NIST CSF 2.0 | `nist_csf_2.0_azure.json` |
+
+### GCP (15+ frameworks)
+| Framework | File Name |
+|-----------|-----------|
+| CIS 2.0, 3.0, 4.0 | `cis_{version}_gcp.json` |
+| ISO 27001:2022 | `iso27001_2022_gcp.json` |
+| HIPAA | `hipaa_gcp.json` |
+| MITRE ATT&CK | `mitre_attack_gcp.json` |
+| PCI DSS 4.0 | `pci_4.0_gcp.json` |
+| NIST CSF 2.0 | `nist_csf_2.0_gcp.json` |
+
+### Kubernetes (6 frameworks)
+| Framework | File Name |
+|-----------|-----------|
+| CIS 1.8, 1.10, 1.11 | `cis_{version}_kubernetes.json` |
+| ISO 27001:2022 | `iso27001_2022_kubernetes.json` |
+| PCI DSS 4.0 | `pci_4.0_kubernetes.json` |
+
+### Other Providers
+- **GitHub:** `cis_1.0_github.json`
+- **M365:** `cis_4.0_m365.json`, `iso27001_2022_m365.json`
+- **NHN:** `iso27001_2022_nhn.json`
+
 ## Best Practices

-1. **Requirement IDs**: Follow the original framework numbering (e.g., "1.1", "2.3.4")
-2. **Check Mapping**: Map to existing checks when possible, create new checks only if needed
-3. **Completeness**: Include all framework requirements, even if no check exists (document as manual)
-4. **Version Control**: Include framework version in the name and file
+1. **Requirement IDs**: Follow the original framework numbering exactly (e.g., "1.1", "A.5.1", "T1190", "ac_2_1")
+2. **Check Mapping**: Map to existing checks when possible. Use `Checks: []` for manual-only requirements
+3. **Completeness**: Include all framework requirements, even those without automated checks
+4. **Version Control**: Include framework version in `Name` and `Version` fields
+5. **File Naming**: Use format `{framework}_{version}_{provider}.json`
+6. **Validation**: Prowler validates JSON against Pydantic models at startup - invalid JSON will cause errors

 ## Commands

 ```bash
 # List available frameworks for a provider
-poetry run python prowler-cli.py {provider} --list-compliance
+prowler {provider} --list-compliance

 # Run scan with specific compliance framework
-poetry run python prowler-cli.py {provider} --compliance {framework}
+prowler aws --compliance cis_5.0_aws

 # Run scan with multiple frameworks
-poetry run python prowler-cli.py {provider} --compliance cis_aws_benchmark_v2 pci_dss_3.2.1
+prowler aws --compliance cis_5.0_aws pci_4.0_aws

-# Output compliance report
-poetry run python prowler-cli.py {provider} --compliance {framework} -M csv json html
+# Output compliance report in multiple formats
+prowler aws --compliance cis_5.0_aws -M csv json html
 ```

+## Code References
+
+- **Compliance Models:** `prowler/lib/check/compliance_models.py`
+- **Compliance Processing:** `prowler/lib/check/compliance.py`
+- **Compliance Output:** `prowler/lib/outputs/compliance/`
+
 ## Resources

- **Templates**: See [assets/](assets/) for complete CIS framework JSON template
- **Documentation**: See [references/compliance-docs.md](references/compliance-docs.md) for official Prowler Developer Guide links
+- **Templates:** See [assets/](assets/) for framework JSON templates
+- **Documentation:** See [references/compliance-docs.md](references/compliance-docs.md) for additional resources