Merge branch 'master' into feature/add-resource-inventory

# Conflicts:
#	ui/types/index.ts

.env

@@ -24,6 +24,10 @@ POSTGRES_USER=prowler
 POSTGRES_PASSWORD=postgres
 POSTGRES_DB=prowler_db
 
+# Celery-Prowler task settings
+TASK_RETRY_DELAY_SECONDS=0.1
+TASK_RETRY_ATTEMPTS=5
+
 # Valkey settings
 # If running Valkey and celery on host, use localhost, else use 'valkey'
 VALKEY_HOST=valkey

.github/workflows/pull-request-merged.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set short git commit SHA
         id: vars
         run: |
-          shortSha=$(git rev-parse --short ${{ github.sha }})
+          shortSha=$(git rev-parse --short ${{ github.event.pull_request.merge_commit_sha }})
           echo "SHORT_SHA=${shortSha}" >> $GITHUB_ENV
 
       - name: Trigger pull request
@@ -28,7 +28,7 @@ jobs:
           repository: ${{ secrets.CLOUD_DISPATCH }}
           event-type: prowler-pull-request-merged
           client-payload: '{
-            "PROWLER_COMMIT_SHA": "${{ github.sha }}",
+            "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
             "PROWLER_COMMIT_SHORT_SHA": "${{ env.SHORT_SHA }}",
             "PROWLER_PR_TITLE": "${{ github.event.pull_request.title }}",
             "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},

README.md

@@ -86,12 +86,12 @@ prowler dashboard
 
 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) |
 |---|---|---|---|---|
-| AWS | 564 | 82 | 34 | 10 |
+| AWS | 567 | 82 | 36 | 10 |
 | GCP | 79 | 13 | 9 | 3 |
-| Azure | 140 | 18 | 8 | 3 |
+| Azure | 142 | 18 | 10 | 3 |
 | Kubernetes | 83 | 7 | 5 | 7 |
-| GitHub | 3 | 2 | 1 | 0 |
-| M365 | 44 | 2 | 2 | 0 |
+| GitHub | 16 | 2 | 1 | 0 |
+| M365 | 69 | 7 | 2 | 2 |
 | NHN (Unofficial) | 6 | 2 | 1 | 0 |
 
 > [!Note]

api/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+## [v1.9.0] (Prowler UNRELEASED)
+
+### Added
+- Support GCP Service Account key. [(#7824)](https://github.com/prowler-cloud/prowler/pull/7824)
+- Added new `GET /compliance-overviews` endpoints to retrieve compliance metadata and specific requirements statuses [(#7877)](https://github.com/prowler-cloud/prowler/pull/7877).
+
+### Changed
+- Renamed field encrypted_password to password for M365 provider [(#7784)](https://github.com/prowler-cloud/prowler/pull/7784)
+- Reworked `GET /compliance-overviews` to return proper requirement metrics [(#7877)](https://github.com/prowler-cloud/prowler/pull/7877).
+
+### Fixed
+- Fixed the connection status verification before launching a scan [(#7831)](https://github.com/prowler-cloud/prowler/pull/7831)
+
+---
+
+## [v1.8.2] (Prowler v5.7.2)
+
+### Fixed
+- Fixed task lookup to use task_kwargs instead of task_args for scan report resolution. [(#7830)](https://github.com/prowler-cloud/prowler/pull/7830)
+- Fixed Kubernetes UID validation to allow valid context names [(#7871)](https://github.com/prowler-cloud/prowler/pull/7871)
+- Fixed a race condition when creating background tasks [(#7876)](https://github.com/prowler-cloud/prowler/pull/7876).
+- Fixed an error when modifying or retrieving tenants due to missing user UUID in transaction context [(#7890)](https://github.com/prowler-cloud/prowler/pull/7890).
+
+---
+
 ## [v1.8.1] (Prowler v5.7.1)
 
 ### Fixed

api/pyproject.toml

@@ -35,7 +35,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.8.1"
+version = "1.9.0"
 
 [project.scripts]
 celery = "src.backend.config.settings.celery"

api/src/backend/api/base_views.py

@@ -109,16 +109,6 @@ class BaseTenantViewset(BaseViewSet):
                 pass  # Tenant might not exist, handle gracefully
 
     def initial(self, request, *args, **kwargs):
-        if (
-            request.resolver_match.url_name != "tenant-detail"
-            and request.method != "DELETE"
-        ):
-            user_id = str(request.user.id)
-
-            with rls_transaction(value=user_id, parameter=POSTGRES_USER_VAR):
-                return super().initial(request, *args, **kwargs)
-
-        # TODO: DRY this when we have time
         if request.auth is None:
             raise NotAuthenticated
 
@@ -126,8 +116,8 @@ class BaseTenantViewset(BaseViewSet):
         if tenant_id is None:
             raise NotAuthenticated("Tenant ID is not present in token")
 
-        with rls_transaction(tenant_id):
-            self.request.tenant_id = tenant_id
+        user_id = str(request.user.id)
+        with rls_transaction(value=user_id, parameter=POSTGRES_USER_VAR):
             return super().initial(request, *args, **kwargs)
 
 

api/src/backend/api/db_utils.py

@@ -1,3 +1,4 @@
+import re
 import secrets
 import uuid
 from contextlib import contextmanager
@@ -152,6 +153,28 @@ def delete_related_daily_task(provider_id: str):
     PeriodicTask.objects.filter(name=task_name).delete()
 
 
+def create_objects_in_batches(
+    tenant_id: str, model, objects: list, batch_size: int = 500
+):
+    """
+    Bulk-create model instances in repeated, per-tenant RLS transactions.
+
+    All chunks execute in their own transaction, so no single transaction
+    grows too large.
+
+    Args:
+        tenant_id (str): UUID string of the tenant under which to set RLS.
+        model: Django model class whose `.objects.bulk_create()` will be called.
+        objects (list): List of model instances (unsaved) to bulk-create.
+        batch_size (int): Maximum number of objects per bulk_create call.
+    """
+    total = len(objects)
+    for i in range(0, total, batch_size):
+        chunk = objects[i : i + batch_size]
+        with rls_transaction(value=tenant_id, parameter=POSTGRES_TENANT_VAR):
+            model.objects.bulk_create(chunk, batch_size)
+
+
 # Postgres Enums
 
 
@@ -227,6 +250,72 @@ def register_enum(apps, schema_editor, enum_class):  # noqa: F841
         register_adapter(enum_class, enum_adapter)
 
 
+def _should_create_index_on_partition(
+    partition_name: str, all_partitions: bool = False
+) -> bool:
+    """
+    Determine if we should create an index on this partition.
+
+    Args:
+        partition_name: The name of the partition (e.g., "findings_2025_aug", "findings_default")
+        all_partitions: If True, create on all partitions. If False, only current/future partitions.
+
+    Returns:
+        bool: True if index should be created on this partition, False otherwise.
+    """
+    if all_partitions:
+        return True
+
+    # Extract date from partition name if it follows the pattern
+    # Partition names look like: findings_2025_aug, findings_2025_jul, etc.
+    date_pattern = r"(\d{4})_([a-z]{3})$"
+    match = re.search(date_pattern, partition_name)
+
+    if not match:
+        # If we can't parse the date, include it to be safe (e.g., default partition)
+        return True
+
+    try:
+        year_str, month_abbr = match.groups()
+        year = int(year_str)
+
+        # Map month abbreviations to numbers
+        month_map = {
+            "jan": 1,
+            "feb": 2,
+            "mar": 3,
+            "apr": 4,
+            "may": 5,
+            "jun": 6,
+            "jul": 7,
+            "aug": 8,
+            "sep": 9,
+            "oct": 10,
+            "nov": 11,
+            "dec": 12,
+        }
+
+        month = month_map.get(month_abbr.lower())
+        if month is None:
+            # Unknown month abbreviation, include it to be safe
+            return True
+
+        partition_date = datetime(year, month, 1, tzinfo=timezone.utc)
+
+        # Get current month start
+        now = datetime.now(timezone.utc)
+        current_month_start = now.replace(
+            day=1, hour=0, minute=0, second=0, microsecond=0
+        )
+
+        # Include current month and future partitions
+        return partition_date >= current_month_start
+
+    except (ValueError, TypeError):
+        # If date parsing fails, include it to be safe
+        return True
+
+
 def create_index_on_partitions(
     apps,  # noqa: F841
     schema_editor,
@@ -235,16 +324,39 @@ def create_index_on_partitions(
     columns: str,
     method: str = "BTREE",
     where: str = "",
+    all_partitions: bool = True,
 ):
     """
-    Create an index on every existing partition of `parent_table`.
+    Create an index on existing partitions of `parent_table`.
 
     Args:
         parent_table: The name of the root table (e.g. "findings").
         index_name: A short name for the index (will be prefixed per-partition).
         columns: The parenthesized column list, e.g. "tenant_id, scan_id, status".
-        method:   The index method—BTREE, GIN, etc.  Defaults to BTREE.
-        where:    Optional WHERE clause (without the leading "WHERE"), e.g. "status = 'FAIL'".
+        method: The index method—BTREE, GIN, etc. Defaults to BTREE.
+        where: Optional WHERE clause (without the leading "WHERE"), e.g. "status = 'FAIL'".
+        all_partitions: Whether to create indexes on all partitions or just current/future ones.
+                       Defaults to False (current/future only) to avoid maintenance overhead
+                       on old partitions where the index may not be needed.
+
+    Examples:
+        # Create index only on current and future partitions (recommended for new indexes)
+        create_index_on_partitions(
+            apps, schema_editor,
+            parent_table="findings",
+            index_name="new_performance_idx",
+            columns="tenant_id, status, severity",
+            all_partitions=False  # Default behavior
+        )
+
+        # Create index on all partitions (use when migrating existing critical indexes)
+        create_index_on_partitions(
+            apps, schema_editor,
+            parent_table="findings",
+            index_name="critical_existing_idx",
+            columns="tenant_id, scan_id",
+            all_partitions=True
+        )
     """
     with connection.cursor() as cursor:
         cursor.execute(
@@ -259,13 +371,14 @@ def create_index_on_partitions(
 
     where_sql = f" WHERE {where}" if where else ""
     for partition in partitions:
-        idx_name = f"{partition.replace('.', '_')}_{index_name}"
-        sql = (
-            f"CREATE INDEX CONCURRENTLY IF NOT EXISTS {idx_name} "
-            f"ON {partition} USING {method} ({columns})"
-            f"{where_sql};"
-        )
-        schema_editor.execute(sql)
+        if _should_create_index_on_partition(partition, all_partitions):
+            idx_name = f"{partition.replace('.', '_')}_{index_name}"
+            sql = (
+                f"CREATE INDEX CONCURRENTLY IF NOT EXISTS {idx_name} "
+                f"ON {partition} USING {method} ({columns})"
+                f"{where_sql};"
+            )
+            schema_editor.execute(sql)
 
 
 def drop_index_on_partitions(
@@ -279,7 +392,7 @@ def drop_index_on_partitions(
 
     Args:
         parent_table: The name of the root table (e.g. "findings").
-        index_name:   The same short name used when creating them.
+        index_name: The same short name used when creating them.
     """
     with connection.cursor() as cursor:
         cursor.execute(

api/src/backend/api/exceptions.py

@@ -3,7 +3,7 @@ from rest_framework import status
 from rest_framework.exceptions import APIException
 from rest_framework_json_api.exceptions import exception_handler
 from rest_framework_json_api.serializers import ValidationError
-from rest_framework_simplejwt.exceptions import TokenError, InvalidToken
+from rest_framework_simplejwt.exceptions import InvalidToken, TokenError
 
 
 class ModelValidationError(ValidationError):
@@ -32,6 +32,31 @@ class InvitationTokenExpiredException(APIException):
     default_code = "token_expired"
 
 
+# Task Management Exceptions (non-HTTP)
+class TaskManagementError(Exception):
+    """Base exception for task management errors."""
+
+    def __init__(self, task=None):
+        self.task = task
+        super().__init__()
+
+
+class TaskFailedException(TaskManagementError):
+    """Raised when a task has failed."""
+
+
+class TaskNotFoundException(TaskManagementError):
+    """Raised when a task is not found."""
+
+
+class TaskInProgressException(TaskManagementError):
+    """Raised when a task is running but there's no related Task object to return."""
+
+    def __init__(self, task_result=None):
+        self.task_result = task_result
+        super().__init__()
+
+
 def custom_exception_handler(exc, context):
     if isinstance(exc, django_validation_error):
         if hasattr(exc, "error_dict"):
@@ -39,7 +64,12 @@ def custom_exception_handler(exc, context):
         else:
             exc = ValidationError(detail=exc.messages[0], code=exc.code)
     elif isinstance(exc, (TokenError, InvalidToken)):
-        exc.detail["messages"] = [
-            message_item["message"] for message_item in exc.detail["messages"]
-        ]
+        if (
+            hasattr(exc, "detail")
+            and isinstance(exc.detail, dict)
+            and "messages" in exc.detail
+        ):
+            exc.detail["messages"] = [
+                message_item["message"] for message_item in exc.detail["messages"]
+            ]
     return exception_handler(exc, context)

api/src/backend/api/filters.py

@@ -22,7 +22,7 @@ from api.db_utils import (
     StatusEnumField,
 )
 from api.models import (
-    ComplianceOverview,
+    ComplianceRequirementOverview,
     Finding,
     Integration,
     Invitation,
@@ -637,12 +637,11 @@ class RoleFilter(FilterSet):
 
 class ComplianceOverviewFilter(FilterSet):
     inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
-    provider_type = ChoiceFilter(choices=Provider.ProviderChoices.choices)
-    provider_type__in = ChoiceInFilter(choices=Provider.ProviderChoices.choices)
-    scan_id = UUIDFilter(field_name="scan__id")
+    scan_id = UUIDFilter(field_name="scan_id")
+    region = CharFilter(field_name="region")
 
     class Meta:
-        model = ComplianceOverview
+        model = ComplianceRequirementOverview
         fields = {
             "inserted_at": ["date", "gte", "lte"],
             "compliance_id": ["exact", "icontains"],

api/src/backend/api/migrations/0026_provider_secret_gcp_service_account.py

@@ -0,0 +1,14 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0025_findings_uid_index_parent"),
+    ]
+
+    operations = [
+        migrations.RunSQL(
+            "ALTER TYPE provider_secret_type ADD VALUE IF NOT EXISTS 'service_account';",
+            reverse_sql=migrations.RunSQL.noop,
+        ),
+    ]

api/src/backend/api/migrations/0027_compliance_requirement_overviews.py

@@ -0,0 +1,124 @@
+# Generated by Django 5.1.8 on 2025-05-21 11:37
+
+import uuid
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+import api.db_utils
+import api.rls
+from api.rls import RowLevelSecurityConstraint
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0026_provider_secret_gcp_service_account"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="ComplianceRequirementOverview",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                ("inserted_at", models.DateTimeField(auto_now_add=True)),
+                ("compliance_id", models.TextField(blank=False)),
+                ("framework", models.TextField(blank=False)),
+                ("version", models.TextField(blank=True)),
+                ("description", models.TextField(blank=True)),
+                ("region", models.TextField(blank=False)),
+                ("requirement_id", models.TextField(blank=False)),
+                (
+                    "requirement_status",
+                    api.db_utils.StatusEnumField(
+                        choices=[
+                            ("FAIL", "Fail"),
+                            ("PASS", "Pass"),
+                            ("MANUAL", "Manual"),
+                        ]
+                    ),
+                ),
+                ("passed_checks", models.IntegerField(default=0)),
+                ("failed_checks", models.IntegerField(default=0)),
+                ("total_checks", models.IntegerField(default=0)),
+                (
+                    "scan",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="compliance_requirements_overviews",
+                        related_query_name="compliance_requirements_overview",
+                        to="api.scan",
+                    ),
+                ),
+                (
+                    "tenant",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, to="api.tenant"
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "compliance_requirements_overviews",
+                "abstract": False,
+                "indexes": [
+                    models.Index(
+                        fields=["tenant_id", "scan_id"], name="cro_tenant_scan_idx"
+                    ),
+                    models.Index(
+                        fields=["tenant_id", "scan_id", "compliance_id"],
+                        name="cro_scan_comp_idx",
+                    ),
+                    models.Index(
+                        fields=["tenant_id", "scan_id", "compliance_id", "region"],
+                        name="cro_scan_comp_reg_idx",
+                    ),
+                    models.Index(
+                        fields=[
+                            "tenant_id",
+                            "scan_id",
+                            "compliance_id",
+                            "requirement_id",
+                        ],
+                        name="cro_scan_comp_req_idx",
+                    ),
+                    models.Index(
+                        fields=[
+                            "tenant_id",
+                            "scan_id",
+                            "compliance_id",
+                            "requirement_id",
+                            "region",
+                        ],
+                        name="cro_scan_comp_req_reg_idx",
+                    ),
+                ],
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=(
+                            "tenant_id",
+                            "scan_id",
+                            "compliance_id",
+                            "requirement_id",
+                            "region",
+                        ),
+                        name="unique_tenant_compliance_requirement_overview",
+                    )
+                ],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="ComplianceRequirementOverview",
+            constraint=RowLevelSecurityConstraint(
+                "tenant_id",
+                name="rls_on_compliancerequirementoverview",
+                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
+            ),
+        ),
+    ]

api/src/backend/api/migrations/0028_findings_check_index_partitions.py

@@ -0,0 +1,29 @@
+from functools import partial
+
+from django.db import migrations
+
+from api.db_utils import create_index_on_partitions, drop_index_on_partitions
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ("api", "0027_compliance_requirement_overviews"),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            partial(
+                create_index_on_partitions,
+                parent_table="findings",
+                index_name="find_tenant_scan_check_idx",
+                columns="tenant_id, scan_id, check_id",
+            ),
+            reverse_code=partial(
+                drop_index_on_partitions,
+                parent_table="findings",
+                index_name="find_tenant_scan_check_idx",
+            ),
+        )
+    ]

api/src/backend/api/migrations/0029_findings_check_index_parent.py

@@ -0,0 +1,17 @@
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0028_findings_check_index_partitions"),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="finding",
+            index=models.Index(
+                fields=["tenant_id", "scan_id", "check_id"],
+                name="find_tenant_scan_check_idx",
+            ),
+        ),
+    ]

api/src/backend/api/models.py

@@ -1,7 +1,9 @@
 import json
 import re
+import time
 from uuid import UUID, uuid4
 
+from config.env import env
 from cryptography.fernet import Fernet
 from django.conf import settings
 from django.contrib.auth.models import AbstractBaseUser
@@ -242,7 +244,7 @@ class Provider(RowLevelSecurityProtectedModel):
     @staticmethod
     def validate_kubernetes_uid(value):
         if not re.match(
-            r"^[a-z0-9][A-Za-z0-9_.:\/-]{1,250}$",
+            r"^[a-zA-Z0-9][a-zA-Z0-9._@:\/-]{1,250}$",
             value,
         ):
             raise ModelValidationError(
@@ -352,6 +354,42 @@ class ProviderGroupMembership(RowLevelSecurityProtectedModel):
         resource_name = "provider_groups-provider"
 
 
+class TaskManager(models.Manager):
+    def get_with_retry(
+        self,
+        id: str,
+        max_retries: int = None,
+        delay_seconds: float = None,
+    ):
+        """
+        Retry fetching a Task by ID in case it hasn't been created yet.
+
+        Args:
+            id (str): The Celery task ID (expected to match Task model PK).
+            max_retries (int, optional): Number of retry attempts. Defaults to env TASK_RETRY_ATTEMPTS or 5.
+            delay_seconds (float, optional): Delay between retries in seconds. Defaults to env TASK_RETRY_DELAY_SECONDS or 0.1.
+
+        Returns:
+            Task: The retrieved Task instance.
+
+        Raises:
+            Task.DoesNotExist: If the task is not found after all retries.
+        """
+        max_retries = max_retries or env.int("TASK_RETRY_ATTEMPTS", default=5)
+        delay_seconds = delay_seconds or env.float(
+            "TASK_RETRY_DELAY_SECONDS", default=0.1
+        )
+
+        for _attempt in range(max_retries):
+            try:
+                return self.get(id=id)
+            except self.model.DoesNotExist:
+                time.sleep(delay_seconds)
+        raise self.model.DoesNotExist(
+            f"Task with ID {id} not found after {max_retries} retries."
+        )
+
+
 class Task(RowLevelSecurityProtectedModel):
     id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
     inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
@@ -364,6 +402,8 @@ class Task(RowLevelSecurityProtectedModel):
         blank=True,
     )
 
+    objects = TaskManager()
+
     class Meta(RowLevelSecurityProtectedModel.Meta):
         db_table = "tasks"
 
@@ -762,6 +802,10 @@ class Finding(PostgresPartitionedModel, RowLevelSecurityProtectedModel):
             GinIndex(fields=["resource_services"], name="gin_find_service_idx"),
             GinIndex(fields=["resource_regions"], name="gin_find_region_idx"),
             GinIndex(fields=["resource_types"], name="gin_find_rtype_idx"),
+            models.Index(
+                fields=["tenant_id", "scan_id", "check_id"],
+                name="find_tenant_scan_check_idx",
+            ),
         ]
 
     class JSONAPIMeta:
@@ -850,6 +894,7 @@ class ProviderSecret(RowLevelSecurityProtectedModel):
     class TypeChoices(models.TextChoices):
         STATIC = "static", _("Key-value pairs")
         ROLE = "role", _("Role assumption")
+        SERVICE_ACCOUNT = "service_account", _("GCP Service Account Key")
 
     id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
     inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
@@ -1142,6 +1187,78 @@ class ComplianceOverview(RowLevelSecurityProtectedModel):
         resource_name = "compliance-overviews"
 
 
+class ComplianceRequirementOverview(RowLevelSecurityProtectedModel):
+    id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
+    inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
+    compliance_id = models.TextField(blank=False)
+    framework = models.TextField(blank=False)
+    version = models.TextField(blank=True)
+    description = models.TextField(blank=True)
+    region = models.TextField(blank=False)
+
+    requirement_id = models.TextField(blank=False)
+    requirement_status = StatusEnumField(choices=StatusChoices)
+    passed_checks = models.IntegerField(default=0)
+    failed_checks = models.IntegerField(default=0)
+    total_checks = models.IntegerField(default=0)
+
+    scan = models.ForeignKey(
+        Scan,
+        on_delete=models.CASCADE,
+        related_name="compliance_requirements_overviews",
+        related_query_name="compliance_requirements_overview",
+    )
+
+    class Meta(RowLevelSecurityProtectedModel.Meta):
+        db_table = "compliance_requirements_overviews"
+
+        constraints = [
+            models.UniqueConstraint(
+                fields=(
+                    "tenant_id",
+                    "scan_id",
+                    "compliance_id",
+                    "requirement_id",
+                    "region",
+                ),
+                name="unique_tenant_compliance_requirement_overview",
+            ),
+            RowLevelSecurityConstraint(
+                field="tenant_id",
+                name="rls_on_%(class)s",
+                statements=["SELECT", "INSERT", "DELETE"],
+            ),
+        ]
+        indexes = [
+            models.Index(fields=["tenant_id", "scan_id"], name="cro_tenant_scan_idx"),
+            models.Index(
+                fields=["tenant_id", "scan_id", "compliance_id"],
+                name="cro_scan_comp_idx",
+            ),
+            models.Index(
+                fields=["tenant_id", "scan_id", "compliance_id", "region"],
+                name="cro_scan_comp_reg_idx",
+            ),
+            models.Index(
+                fields=["tenant_id", "scan_id", "compliance_id", "requirement_id"],
+                name="cro_scan_comp_req_idx",
+            ),
+            models.Index(
+                fields=[
+                    "tenant_id",
+                    "scan_id",
+                    "compliance_id",
+                    "requirement_id",
+                    "region",
+                ],
+                name="cro_scan_comp_req_reg_idx",
+            ),
+        ]
+
+    class JSONAPIMeta:
+        resource_name = "compliance-requirements-overviews"
+
+
 class ScanSummary(RowLevelSecurityProtectedModel):
     objects = ActiveProviderManager()
     all_objects = models.Manager()

api/src/backend/api/pagination.py

@@ -1,4 +1,4 @@
-from rest_framework_json_api.pagination import JsonApiPageNumberPagination
+from drf_spectacular_jsonapi.schemas.pagination import JsonApiPageNumberPagination
 
 
 class ComplianceOverviewPagination(JsonApiPageNumberPagination):

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.8.1
+  version: 1.9.0
   description: |-
     Prowler API specification.
 
@@ -10,9 +10,7 @@ paths:
   /api/v1/compliance-overviews:
     get:
       operationId: compliance_overviews_list
-      description: Retrieve an overview of all the compliance in a given scan. If
-        no region filters are provided, the region with the most fails will be returned
-        by default.
+      description: Retrieve an overview of all the compliance in a given scan.
       summary: List compliance overviews for a scan
       parameters:
       - in: query
@@ -22,15 +20,13 @@ paths:
           items:
             type: string
             enum:
-            - inserted_at
-            - compliance_id
+            - id
             - framework
             - version
-            - requirements_status
-            - region
-            - provider_type
-            - scan
-            - url
+            - requirements_passed
+            - requirements_failed
+            - requirements_manual
+            - total_requirements
         description: endpoint return only specific fields in the response on a per-type
           basis by including a fields[TYPE] query parameter.
         explode: false
@@ -74,44 +70,6 @@ paths:
         schema:
           type: string
           format: date-time
-      - in: query
-        name: filter[provider_type]
-        schema:
-          type: string
-          enum:
-          - aws
-          - azure
-          - gcp
-          - kubernetes
-          - m365
-        description: |-
-          * `aws` - AWS
-          * `azure` - Azure
-          * `gcp` - GCP
-          * `kubernetes` - Kubernetes
-          * `m365` - M365
-      - in: query
-        name: filter[provider_type__in]
-        schema:
-          type: array
-          items:
-            type: string
-            enum:
-            - aws
-            - azure
-            - gcp
-            - kubernetes
-            - m365
-        description: |-
-          Multiple values may be separated by commas.
-
-          * `aws` - AWS
-          * `azure` - Azure
-          * `gcp` - GCP
-          * `kubernetes` - Kubernetes
-          * `m365` - M365
-        explode: false
-        style: form
       - in: query
         name: filter[region]
         schema:
@@ -171,14 +129,8 @@ paths:
           items:
             type: string
             enum:
-            - inserted_at
-            - -inserted_at
             - compliance_id
             - -compliance_id
-            - framework
-            - -framework
-            - region
-            - -region
         explode: false
       tags:
       - Compliance Overview
@@ -190,41 +142,43 @@ paths:
             application/vnd.api+json:
               schema:
                 $ref: '#/components/schemas/PaginatedComplianceOverviewList'
-          description: ''
-  /api/v1/compliance-overviews/{id}:
+          description: Compliance overviews obtained successfully
+        '202':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/PaginatedTaskList'
+          description: The task is in progress
+        '500':
+          description: Compliance overviews generation task failed
+  /api/v1/compliance-overviews/attributes:
     get:
-      operationId: compliance_overviews_retrieve
-      description: Fetch detailed information about a specific compliance overview
-        by its ID, including detailed requirement information and check's status.
-      summary: Retrieve data from a specific compliance overview
+      operationId: compliance_overviews_attributes_retrieve
+      description: Retrieve detailed attribute information for all requirements in
+        a specific compliance framework along with the associated check IDs for each
+        requirement.
+      summary: Get compliance requirement attributes
       parameters:
       - in: query
-        name: fields[compliance-overviews]
+        name: fields[compliance-requirements-attributes]
         schema:
           type: array
           items:
             type: string
             enum:
-            - inserted_at
-            - compliance_id
+            - id
             - framework
             - version
-            - requirements_status
-            - region
-            - provider_type
-            - scan
-            - url
             - description
-            - requirements
+            - attributes
         description: endpoint return only specific fields in the response on a per-type
           basis by including a fields[TYPE] query parameter.
         explode: false
-      - in: path
-        name: id
+      - in: query
+        name: filter[compliance_id]
         schema:
           type: string
-          format: uuid
-        description: A UUID string identifying this compliance overview.
+        description: Compliance framework ID to get attributes for.
         required: true
       tags:
       - Compliance Overview
@@ -235,8 +189,8 @@ paths:
           content:
             application/vnd.api+json:
               schema:
-                $ref: '#/components/schemas/ComplianceOverviewFullResponse'
-          description: ''
+                $ref: '#/components/schemas/PaginatedComplianceOverviewAttributesList'
+          description: Compliance attributes obtained successfully
   /api/v1/compliance-overviews/metadata:
     get:
       operationId: compliance_overviews_metadata_retrieve
@@ -271,8 +225,142 @@ paths:
           content:
             application/vnd.api+json:
               schema:
-                $ref: '#/components/schemas/ComplianceOverviewMetadataResponse'
-          description: ''
+                $ref: '#/components/schemas/OpenApiResponseResponse'
+          description: Compliance overviews metadata obtained successfully
+        '202':
+          description: The task is in progress
+        '500':
+          description: Compliance overviews generation task failed
+  /api/v1/compliance-overviews/requirements:
+    get:
+      operationId: compliance_overviews_requirements_retrieve
+      description: Retrieve a detailed overview of compliance requirements in a given
+        scan, grouped by compliance framework. This endpoint provides requirement-level
+        details and aggregates status across regions.
+      summary: List compliance requirements overview for a scan
+      parameters:
+      - in: query
+        name: fields[compliance-requirements-details]
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - id
+            - framework
+            - version
+            - description
+            - status
+        description: endpoint return only specific fields in the response on a per-type
+          basis by including a fields[TYPE] query parameter.
+        explode: false
+      - in: query
+        name: filter[compliance_id]
+        schema:
+          type: string
+        description: Compliance ID.
+        required: true
+      - in: query
+        name: filter[compliance_id__icontains]
+        schema:
+          type: string
+      - in: query
+        name: filter[framework]
+        schema:
+          type: string
+      - in: query
+        name: filter[framework__icontains]
+        schema:
+          type: string
+      - in: query
+        name: filter[framework__iexact]
+        schema:
+          type: string
+      - in: query
+        name: filter[inserted_at]
+        schema:
+          type: string
+          format: date
+      - in: query
+        name: filter[inserted_at__date]
+        schema:
+          type: string
+          format: date
+      - in: query
+        name: filter[inserted_at__gte]
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: filter[inserted_at__lte]
+        schema:
+          type: string
+          format: date-time
+      - in: query
+        name: filter[region]
+        schema:
+          type: string
+      - in: query
+        name: filter[region__icontains]
+        schema:
+          type: string
+      - in: query
+        name: filter[region__in]
+        schema:
+          type: array
+          items:
+            type: string
+        description: Multiple values may be separated by commas.
+        explode: false
+        style: form
+      - in: query
+        name: filter[scan_id]
+        schema:
+          type: string
+          format: uuid
+        description: Related scan ID.
+        required: true
+      - name: filter[search]
+        required: false
+        in: query
+        description: A search term.
+        schema:
+          type: string
+      - in: query
+        name: filter[version]
+        schema:
+          type: string
+      - in: query
+        name: filter[version__icontains]
+        schema:
+          type: string
+      - name: sort
+        required: false
+        in: query
+        description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)'
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - compliance_id
+            - -compliance_id
+        explode: false
+      tags:
+      - Compliance Overview
+      security:
+      - jwtAuth: []
+      responses:
+        '200':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/PaginatedComplianceOverviewDetailList'
+          description: Compliance requirement details obtained successfully
+        '202':
+          description: The task is in progress
+        '500':
+          description: Compliance overviews generation task failed
   /api/v1/findings:
     get:
       operationId: findings_list
@@ -5376,7 +5464,8 @@ paths:
         '403':
           description: There is a problem with credentials
         '404':
-          description: The scan has no reports
+          description: The scan has no reports, or the report generation task has
+            not started yet
   /api/v1/schedules/daily:
     post:
       operationId: schedules_daily_create
@@ -6838,80 +6927,37 @@ components:
       properties:
         type:
           allOf:
-          - $ref: '#/components/schemas/Type7f7Enum'
+          - $ref: '#/components/schemas/ComplianceOverviewTypeEnum'
           description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
             member is used to describe resource objects that share common attributes
             and relationships.
-        id:
-          type: string
-          format: uuid
+        id: {}
         attributes:
           type: object
           properties:
-            inserted_at:
+            id:
               type: string
-              format: date-time
-              readOnly: true
-            compliance_id:
-              type: string
-              maxLength: 100
             framework:
               type: string
-              maxLength: 100
             version:
               type: string
-              maxLength: 50
-            requirements_status:
-              type: object
-              properties:
-                passed:
-                  type: integer
-                failed:
-                  type: integer
-                manual:
-                  type: integer
-                total:
-                  type: integer
-              readOnly: true
-            region:
-              type: string
-              maxLength: 50
-            provider_type:
-              type: string
-              nullable: true
-              readOnly: true
+            requirements_passed:
+              type: integer
+            requirements_failed:
+              type: integer
+            requirements_manual:
+              type: integer
+            total_requirements:
+              type: integer
           required:
-          - compliance_id
+          - id
           - framework
-        relationships:
-          type: object
-          properties:
-            scan:
-              type: object
-              properties:
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    type:
-                      type: string
-                      enum:
-                      - scans
-                      title: Resource Type Name
-                      description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
-                        member is used to describe resource objects that share common
-                        attributes and relationships.
-                  required:
-                  - id
-                  - type
-              required:
-              - data
-              description: The identifier of the related object.
-              title: Resource Identifier
-              nullable: true
-    ComplianceOverviewFull:
+          - version
+          - requirements_passed
+          - requirements_failed
+          - requirements_manual
+          - total_requirements
+    ComplianceOverviewAttributes:
       type: object
       required:
       - type
@@ -6920,134 +6966,78 @@ components:
       properties:
         type:
           allOf:
-          - $ref: '#/components/schemas/Type7f7Enum'
+          - $ref: '#/components/schemas/ComplianceOverviewAttributesTypeEnum'
           description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
             member is used to describe resource objects that share common attributes
             and relationships.
-        id:
-          type: string
-          format: uuid
+        id: {}
         attributes:
           type: object
           properties:
-            inserted_at:
+            id:
               type: string
-              format: date-time
-              readOnly: true
-            compliance_id:
-              type: string
-              maxLength: 100
             framework:
               type: string
-              maxLength: 100
             version:
               type: string
-              maxLength: 50
-            requirements_status:
-              type: object
-              properties:
-                passed:
-                  type: integer
-                failed:
-                  type: integer
-                manual:
-                  type: integer
-                total:
-                  type: integer
-              readOnly: true
-            region:
-              type: string
-              maxLength: 50
-            provider_type:
-              type: string
-              nullable: true
-              readOnly: true
             description:
               type: string
-            requirements:
-              type: object
-              properties:
-                requirement_id:
-                  type: object
-                  properties:
-                    name:
-                      type: string
-                    checks:
-                      type: object
-                      properties:
-                        check_name:
-                          type: object
-                          properties:
-                            status:
-                              type: string
-                              enum:
-                              - PASS
-                              - FAIL
-                              - null
-                      description: Each key in the 'checks' object is a check name,
-                        with values as 'PASS', 'FAIL', or null.
-                    status:
-                      type: string
-                      enum:
-                      - PASS
-                      - FAIL
-                      - MANUAL
-                    attributes:
-                      type: array
-                      items:
-                        type: object
-                    description:
-                      type: string
-                    checks_status:
-                      type: object
-                      properties:
-                        total:
-                          type: integer
-                        pass:
-                          type: integer
-                        fail:
-                          type: integer
-                        manual:
-                          type: integer
-              readOnly: true
+            attributes: {}
           required:
-          - compliance_id
+          - id
           - framework
-        relationships:
+          - version
+          - description
+          - attributes
+    ComplianceOverviewAttributesTypeEnum:
+      type: string
+      enum:
+      - compliance-requirements-attributes
+    ComplianceOverviewDetail:
+      type: object
+      required:
+      - type
+      - id
+      additionalProperties: false
+      properties:
+        type:
+          allOf:
+          - $ref: '#/components/schemas/ComplianceOverviewDetailTypeEnum'
+          description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+            member is used to describe resource objects that share common attributes
+            and relationships.
+        id: {}
+        attributes:
           type: object
           properties:
-            scan:
-              type: object
-              properties:
-                data:
-                  type: object
-                  properties:
-                    id:
-                      type: string
-                      format: uuid
-                    type:
-                      type: string
-                      enum:
-                      - scans
-                      title: Resource Type Name
-                      description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
-                        member is used to describe resource objects that share common
-                        attributes and relationships.
-                  required:
-                  - id
-                  - type
-              required:
-              - data
-              description: The identifier of the related object.
-              title: Resource Identifier
-              nullable: true
-    ComplianceOverviewFullResponse:
-      type: object
-      properties:
-        data:
-          $ref: '#/components/schemas/ComplianceOverviewFull'
-      required:
-      - data
+            id:
+              type: string
+            framework:
+              type: string
+            version:
+              type: string
+            description:
+              type: string
+            status:
+              enum:
+              - FAIL
+              - PASS
+              - MANUAL
+              type: string
+              description: |-
+                * `FAIL` - Fail
+                * `PASS` - Pass
+                * `MANUAL` - Manual
+          required:
+          - id
+          - framework
+          - version
+          - description
+          - status
+    ComplianceOverviewDetailTypeEnum:
+      type: string
+      enum:
+      - compliance-requirements-details
     ComplianceOverviewMetadata:
       type: object
       required:
@@ -7071,17 +7061,14 @@ components:
                 type: string
           required:
           - regions
-    ComplianceOverviewMetadataResponse:
-      type: object
-      properties:
-        data:
-          $ref: '#/components/schemas/ComplianceOverviewMetadata'
-      required:
-      - data
     ComplianceOverviewMetadataTypeEnum:
       type: string
       enum:
       - compliance-overviews-metadata
+    ComplianceOverviewTypeEnum:
+      type: string
+      enum:
+      - compliance-overviews
     Finding:
       type: object
       required:
@@ -8385,7 +8372,7 @@ components:
       type: object
       properties:
         data:
-          $ref: '#/components/schemas/Membership'
+          $ref: '#/components/schemas/ComplianceOverviewMetadata'
       required:
       - data
     OverviewFinding:
@@ -8600,29 +8587,33 @@ components:
       type: string
       enum:
       - findings-severity-overview
+    PaginatedComplianceOverviewAttributesList:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/ComplianceOverviewAttributes'
+      required:
+      - data
+    PaginatedComplianceOverviewDetailList:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/ComplianceOverviewDetail'
+      required:
+      - data
     PaginatedComplianceOverviewList:
       type: object
-      required:
-      - count
-      - results
       properties:
-        count:
-          type: integer
-          example: 123
-        next:
-          type: string
-          nullable: true
-          format: uri
-          example: http://api.example.org/accounts/?page[number]=4
-        previous:
-          type: string
-          nullable: true
-          format: uri
-          example: http://api.example.org/accounts/?page[number]=2
-        results:
+        data:
           type: array
           items:
             $ref: '#/components/schemas/ComplianceOverview'
+      required:
+      - data
     PaginatedFindingList:
       type: object
       properties:
@@ -9136,10 +9127,12 @@ components:
                   enum:
                   - static
                   - role
+                  - service_account
                   type: string
                   description: |-
                     * `static` - Key-value pairs
                     * `role` - Role assumption
+                    * `service_account` - GCP Service Account Key
                   readOnly: true
                 secret:
                   oneOf:
@@ -9240,15 +9233,15 @@ components:
                       user:
                         type: email
                         description: User microsoft email address.
-                      encrypted_password:
+                      password:
                         type: string
-                        description: User encrypted password.
+                        description: User password.
                     required:
                     - client_id
                     - client_secret
                     - tenant_id
                     - user
-                    - encrypted_password
+                    - password
                   - type: object
                     title: GCP Static Credentials
                     properties:
@@ -9268,6 +9261,14 @@ components:
                     - client_id
                     - client_secret
                     - refresh_token
+                  - type: object
+                    title: GCP Service Account Key
+                    properties:
+                      service_account_key:
+                        type: object
+                        description: The service account key for GCP.
+                    required:
+                    - service_account_key
                   - type: object
                     title: Kubernetes Static Credentials
                     properties:
@@ -10316,10 +10317,12 @@ components:
               enum:
               - static
               - role
+              - service_account
               type: string
               description: |-
                 * `static` - Key-value pairs
                 * `role` - Role assumption
+                * `service_account` - GCP Service Account Key
           required:
           - secret_type
         relationships:
@@ -10383,10 +10386,12 @@ components:
               enum:
               - static
               - role
+              - service_account
               type: string
               description: |-
                 * `static` - Key-value pairs
                 * `role` - Role assumption
+                * `service_account` - GCP Service Account Key
             secret:
               oneOf:
               - type: object
@@ -10485,15 +10490,15 @@ components:
                   user:
                     type: email
                     description: User microsoft email address.
-                  encrypted_password:
+                  password:
                     type: string
-                    description: User encrypted password.
+                    description: User password.
                 required:
                 - client_id
                 - client_secret
                 - tenant_id
                 - user
-                - encrypted_password
+                - password
               - type: object
                 title: GCP Static Credentials
                 properties:
@@ -10513,6 +10518,14 @@ components:
                 - client_id
                 - client_secret
                 - refresh_token
+              - type: object
+                title: GCP Service Account Key
+                properties:
+                  service_account_key:
+                    type: object
+                    description: The service account key for GCP.
+                required:
+                - service_account_key
               - type: object
                 title: Kubernetes Static Credentials
                 properties:
@@ -10591,10 +10604,12 @@ components:
                   enum:
                   - static
                   - role
+                  - service_account
                   type: string
                   description: |-
                     * `static` - Key-value pairs
                     * `role` - Role assumption
+                    * `service_account` - GCP Service Account Key
                 secret:
                   oneOf:
                   - type: object
@@ -10694,15 +10709,15 @@ components:
                       user:
                         type: email
                         description: User microsoft email address.
-                      encrypted_password:
+                      password:
                         type: string
-                        description: User encrypted password.
+                        description: User password.
                     required:
                     - client_id
                     - client_secret
                     - tenant_id
                     - user
-                    - encrypted_password
+                    - password
                   - type: object
                     title: GCP Static Credentials
                     properties:
@@ -10722,6 +10737,14 @@ components:
                     - client_id
                     - client_secret
                     - refresh_token
+                  - type: object
+                    title: GCP Service Account Key
+                    properties:
+                      service_account_key:
+                        type: object
+                        description: The service account key for GCP.
+                    required:
+                    - service_account_key
                   - type: object
                     title: Kubernetes Static Credentials
                     properties:
@@ -10816,10 +10839,12 @@ components:
               enum:
               - static
               - role
+              - service_account
               type: string
               description: |-
                 * `static` - Key-value pairs
                 * `role` - Role assumption
+                * `service_account` - GCP Service Account Key
               readOnly: true
             secret:
               oneOf:
@@ -10919,15 +10944,15 @@ components:
                   user:
                     type: email
                     description: User microsoft email address.
-                  encrypted_password:
+                  password:
                     type: string
-                    description: User encrypted password.
+                    description: User password.
                 required:
                 - client_id
                 - client_secret
                 - tenant_id
                 - user
-                - encrypted_password
+                - password
               - type: object
                 title: GCP Static Credentials
                 properties:
@@ -10947,6 +10972,14 @@ components:
                 - client_id
                 - client_secret
                 - refresh_token
+              - type: object
+                title: GCP Service Account Key
+                properties:
+                  service_account_key:
+                    type: object
+                    description: The service account key for GCP.
+                required:
+                - service_account_key
               - type: object
                 title: Kubernetes Static Credentials
                 properties:
@@ -11861,6 +11894,7 @@ components:
       type: object
       required:
       - type
+      - id
       additionalProperties: false
       properties:
         type:
@@ -11869,6 +11903,9 @@ components:
           description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
             member is used to describe resource objects that share common attributes
             and relationships.
+        id:
+          type: string
+          format: uuid
         attributes:
           type: object
           properties:
@@ -12283,10 +12320,6 @@ components:
       type: string
       enum:
       - roles
-    Type7f7Enum:
-      type: string
-      enum:
-      - compliance-overviews
     Type8cdEnum:
       type: string
       enum:

api/src/backend/api/tests/test_db_utils.py

@@ -3,9 +3,13 @@ from enum import Enum
 from unittest.mock import patch
 
 import pytest
+from django.conf import settings
+from freezegun import freeze_time
 
 from api.db_utils import (
+    _should_create_index_on_partition,
     batch_delete,
+    create_objects_in_batches,
     enum_to_choices,
     generate_random_token,
     one_week_from_now,
@@ -138,3 +142,88 @@ class TestBatchDelete:
         )
         assert Provider.objects.all().count() == 0
         assert summary == {"api.Provider": create_test_providers}
+
+
+class TestShouldCreateIndexOnPartition:
+    @freeze_time("2025-05-15 00:00:00Z")
+    @pytest.mark.parametrize(
+        "partition_name, all_partitions, expected",
+        [
+            ("any_name", True, True),
+            ("findings_default", True, True),
+            ("findings_2022_jan", True, True),
+            ("foo_bar", False, True),
+            ("findings_2025_MAY", False, True),
+            ("findings_2025_may", False, True),
+            ("findings_2025_jun", False, True),
+            ("findings_2025_apr", False, False),
+            ("findings_2025_xyz", False, True),
+        ],
+    )
+    def test_partition_inclusion_logic(self, partition_name, all_partitions, expected):
+        assert (
+            _should_create_index_on_partition(partition_name, all_partitions)
+            is expected
+        )
+
+    @freeze_time("2025-05-15 00:00:00Z")
+    def test_invalid_date_components(self):
+        # even if regex matches but int conversion fails, we fallback True
+        # (e.g. year too big, month number parse error)
+        bad_name = "findings_99999_jan"
+        assert _should_create_index_on_partition(bad_name, False) is True
+
+        bad_name2 = "findings_2025_abc"
+        # abc not in month_map → fallback True
+        assert _should_create_index_on_partition(bad_name2, False) is True
+
+
+@pytest.mark.django_db
+class TestCreateObjectsInBatches:
+    @pytest.fixture
+    def tenant(self, tenants_fixture):
+        return tenants_fixture[0]
+
+    def make_provider_instances(self, tenant, count):
+        """
+        Return a list of `count` unsaved Provider instances for the given tenant.
+        """
+        base_uid = 1000
+        return [
+            Provider(
+                tenant=tenant,
+                uid=str(base_uid + i),
+                provider=Provider.ProviderChoices.AWS,
+            )
+            for i in range(count)
+        ]
+
+    def test_exact_multiple_of_batch(self, tenant):
+        total = 6
+        batch_size = 3
+        objs = self.make_provider_instances(tenant, total)
+
+        create_objects_in_batches(str(tenant.id), Provider, objs, batch_size=batch_size)
+
+        qs = Provider.objects.filter(tenant=tenant)
+        assert qs.count() == total
+
+    def test_non_multiple_of_batch(self, tenant):
+        total = 7
+        batch_size = 3
+        objs = self.make_provider_instances(tenant, total)
+
+        create_objects_in_batches(str(tenant.id), Provider, objs, batch_size=batch_size)
+
+        qs = Provider.objects.filter(tenant=tenant)
+        assert qs.count() == total
+
+    def test_batch_size_default(self, tenant):
+        default_size = settings.DJANGO_DELETION_BATCH_SIZE
+        total = default_size + 2
+        objs = self.make_provider_instances(tenant, total)
+
+        create_objects_in_batches(str(tenant.id), Provider, objs)
+
+        qs = Provider.objects.filter(tenant=tenant)
+        assert qs.count() == total

api/src/backend/api/tests/test_mixins.py

@@ -0,0 +1,379 @@
+import json
+from uuid import uuid4
+
+import pytest
+from django_celery_results.models import TaskResult
+from rest_framework import status
+from rest_framework.response import Response
+
+from api.exceptions import (
+    TaskFailedException,
+    TaskInProgressException,
+    TaskNotFoundException,
+)
+from api.models import Task, User
+from api.rls import Tenant
+from api.v1.mixins import PaginateByPkMixin, TaskManagementMixin
+
+
+@pytest.mark.django_db
+class TestPaginateByPkMixin:
+    @pytest.fixture
+    def tenant(self):
+        return Tenant.objects.create(name="Test Tenant")
+
+    @pytest.fixture
+    def users(self, tenant):
+        # Create 5 users with proper email field
+        users = []
+        for i in range(5):
+            user = User.objects.create(email=f"user{i}@example.com", name=f"User {i}")
+            users.append(user)
+        return users
+
+    class DummyView(PaginateByPkMixin):
+        def __init__(self, page):
+            self._page = page
+
+        def paginate_queryset(self, qs):
+            return self._page
+
+        def get_serializer(self, queryset, many):
+            class S:
+                def __init__(self, data):
+                    # serialize to list of ids
+                    self.data = [obj.id for obj in data] if many else queryset.id
+
+            return S(queryset)
+
+        def get_paginated_response(self, data):
+            return Response({"results": data}, status=status.HTTP_200_OK)
+
+    def test_no_pagination(self, users):
+        base_qs = User.objects.all().order_by("id")
+        view = self.DummyView(page=None)
+        resp = view.paginate_by_pk(
+            request=None, base_queryset=base_qs, manager=User.objects
+        )
+        # since no pagination, should return all ids in order
+        expected = [u.id for u in base_qs]
+        assert isinstance(resp, Response)
+        assert resp.data == expected
+
+    def test_with_pagination(self, users):
+        base_qs = User.objects.all().order_by("id")
+        # simulate paging to first 2 ids
+        page = [base_qs[1].id, base_qs[3].id]
+        view = self.DummyView(page=page)
+        resp = view.paginate_by_pk(
+            request=None, base_queryset=base_qs, manager=User.objects
+        )
+        # should fetch only those two users, in the same order as page
+        assert resp.status_code == status.HTTP_200_OK
+        assert resp.data == {"results": page}
+
+
+@pytest.mark.django_db
+class TestTaskManagementMixin:
+    class DummyView(TaskManagementMixin):
+        pass
+
+    @pytest.fixture
+    def tenant(self):
+        return Tenant.objects.create(name="Test Tenant")
+
+    @pytest.fixture(autouse=True)
+    def cleanup(self):
+        Task.objects.all().delete()
+        TaskResult.objects.all().delete()
+
+    def test_no_task_and_no_taskresult_raises_not_found(self):
+        view = self.DummyView()
+        with pytest.raises(TaskNotFoundException):
+            view.check_task_status("task_xyz", {"foo": "bar"})
+
+    def test_no_task_and_no_taskresult_returns_none_when_not_raising(self):
+        view = self.DummyView()
+        result = view.check_task_status(
+            "task_xyz", {"foo": "bar"}, raise_on_not_found=False
+        )
+        assert result is None
+
+    def test_taskresult_pending_raises_in_progress(self):
+        task_kwargs = {"foo": "bar"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_xyz",
+            task_kwargs=json.dumps(task_kwargs),
+            status="PENDING",
+        )
+        view = self.DummyView()
+        with pytest.raises(TaskInProgressException) as excinfo:
+            view.check_task_status("task_xyz", task_kwargs, raise_on_not_found=False)
+        assert hasattr(excinfo.value, "task_result")
+        assert excinfo.value.task_result == tr
+
+    def test_taskresult_started_raises_in_progress(self):
+        task_kwargs = {"foo": "bar"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_xyz",
+            task_kwargs=json.dumps(task_kwargs),
+            status="STARTED",
+        )
+        view = self.DummyView()
+        with pytest.raises(TaskInProgressException) as excinfo:
+            view.check_task_status("task_xyz", task_kwargs, raise_on_not_found=False)
+        assert hasattr(excinfo.value, "task_result")
+        assert excinfo.value.task_result == tr
+
+    def test_taskresult_progress_raises_in_progress(self):
+        task_kwargs = {"foo": "bar"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_xyz",
+            task_kwargs=json.dumps(task_kwargs),
+            status="PROGRESS",
+        )
+        view = self.DummyView()
+        with pytest.raises(TaskInProgressException) as excinfo:
+            view.check_task_status("task_xyz", task_kwargs, raise_on_not_found=False)
+        assert hasattr(excinfo.value, "task_result")
+        assert excinfo.value.task_result == tr
+
+    def test_taskresult_failure_raises_failed(self):
+        task_kwargs = {"a": 1}
+        TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_fail",
+            task_kwargs=json.dumps(task_kwargs),
+            status="FAILURE",
+        )
+        view = self.DummyView()
+        with pytest.raises(TaskFailedException):
+            view.check_task_status("task_fail", task_kwargs, raise_on_not_found=False)
+
+    def test_taskresult_failure_returns_none_when_not_raising(self):
+        task_kwargs = {"a": 1}
+        TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_fail",
+            task_kwargs=json.dumps(task_kwargs),
+            status="FAILURE",
+        )
+        view = self.DummyView()
+        result = view.check_task_status(
+            "task_fail", task_kwargs, raise_on_failed=False, raise_on_not_found=False
+        )
+        assert result is None
+
+    def test_taskresult_success_returns_none(self):
+        task_kwargs = {"x": 2}
+        TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_ok",
+            task_kwargs=json.dumps(task_kwargs),
+            status="SUCCESS",
+        )
+        view = self.DummyView()
+        # should not raise, and returns None
+        assert (
+            view.check_task_status("task_ok", task_kwargs, raise_on_not_found=False)
+            is None
+        )
+
+    def test_taskresult_revoked_returns_none(self):
+        task_kwargs = {"x": 2}
+        TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="task_revoked",
+            task_kwargs=json.dumps(task_kwargs),
+            status="REVOKED",
+        )
+        view = self.DummyView()
+        # should not raise, and returns None
+        assert (
+            view.check_task_status(
+                "task_revoked", task_kwargs, raise_on_not_found=False
+            )
+            is None
+        )
+
+    def test_task_with_failed_status_raises_failed(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="FAILURE",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        with pytest.raises(TaskFailedException) as excinfo:
+            view.check_task_status("scan_task", task_kwargs)
+        # Check that the exception contains the expected task
+        assert hasattr(excinfo.value, "task")
+        assert excinfo.value.task == task
+
+    def test_task_with_cancelled_status_raises_failed(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="REVOKED",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        with pytest.raises(TaskFailedException) as excinfo:
+            view.check_task_status("scan_task", task_kwargs)
+        # Check that the exception contains the expected task
+        assert hasattr(excinfo.value, "task")
+        assert excinfo.value.task == task
+
+    def test_task_with_failed_status_returns_task_when_not_raising(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="FAILURE",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.check_task_status("scan_task", task_kwargs, raise_on_failed=False)
+        assert result == task
+
+    def test_task_with_completed_status_returns_none(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="SUCCESS",
+        )
+        Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.check_task_status("scan_task", task_kwargs)
+        assert result is None
+
+    def test_task_with_executing_status_returns_task(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="STARTED",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.check_task_status("scan_task", task_kwargs)
+        assert result is not None
+        assert result.pk == task.pk
+
+    def test_task_with_pending_status_returns_task(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="PENDING",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.check_task_status("scan_task", task_kwargs)
+        assert result is not None
+        assert result.pk == task.pk
+
+    def test_get_task_response_if_running_returns_none_for_completed_task(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="SUCCESS",
+        )
+        Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.get_task_response_if_running("scan_task", task_kwargs)
+        assert result is None
+
+    def test_get_task_response_if_running_returns_none_for_no_task(self):
+        view = self.DummyView()
+        result = view.get_task_response_if_running(
+            "nonexistent", {"foo": "bar"}, raise_on_not_found=False
+        )
+        assert result is None
+
+    def test_get_task_response_if_running_returns_202_for_executing_task(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="STARTED",
+        )
+        task = Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.get_task_response_if_running("scan_task", task_kwargs)
+
+        assert isinstance(result, Response)
+        assert result.status_code == status.HTTP_202_ACCEPTED
+        assert "Content-Location" in result.headers
+        # The response should contain the serialized task data
+        assert result.data is not None
+        assert "id" in result.data
+        assert str(result.data["id"]) == str(task.id)
+
+    def test_get_task_response_if_running_returns_none_for_available_task(self, tenant):
+        task_kwargs = {"provider_id": "test"}
+        tr = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs),
+            status="PENDING",
+        )
+        Task.objects.create(tenant=tenant, task_runner_task=tr)
+        view = self.DummyView()
+        result = view.get_task_response_if_running("scan_task", task_kwargs)
+        # PENDING maps to AVAILABLE, which is not EXECUTING, so should return None
+        assert result is None
+
+    def test_kwargs_filtering_works_correctly(self, tenant):
+        # Create tasks with different kwargs
+        task_kwargs_1 = {"provider_id": "test1", "scan_type": "full"}
+        task_kwargs_2 = {"provider_id": "test2", "scan_type": "quick"}
+
+        tr1 = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs_1),
+            status="STARTED",
+        )
+        tr2 = TaskResult.objects.create(
+            task_id=str(uuid4()),
+            task_name="scan_task",
+            task_kwargs=json.dumps(task_kwargs_2),
+            status="STARTED",
+        )
+
+        task1 = Task.objects.create(tenant=tenant, task_runner_task=tr1)
+        task2 = Task.objects.create(tenant=tenant, task_runner_task=tr2)
+
+        view = self.DummyView()
+
+        # Should find task1 when searching for its kwargs
+        result1 = view.check_task_status("scan_task", {"provider_id": "test1"})
+        assert result1 is not None
+        assert result1.pk == task1.pk
+
+        # Should find task2 when searching for its kwargs
+        result2 = view.check_task_status("scan_task", {"provider_id": "test2"})
+        assert result2 is not None
+        assert result2.pk == task2.pk
+
+        # Should not find anything when searching for non-existent kwargs
+        result3 = view.check_task_status(
+            "scan_task", {"provider_id": "test3"}, raise_on_not_found=False
+        )
+        assert result3 is None

api/src/backend/api/tests/test_models.py

@@ -1,6 +1,9 @@
+import uuid
+from unittest import mock
+
 import pytest
 
-from api.models import Resource, ResourceTag
+from api.models import Resource, ResourceTag, Task
 
 
 @pytest.mark.django_db
@@ -120,3 +123,35 @@ class TestResourceModel:
 #             compliance={},
 #         )
 #         assert Finding.objects.filter(uid=long_uid).exists()
+
+
+@pytest.mark.django_db
+class TestTaskManager:
+    def test_get_with_retry_success(self):
+        task_id = uuid.uuid4()
+        call_counter = {"count": 0}
+
+        def side_effect(*args, **kwargs):
+            if call_counter["count"] < 2:
+                call_counter["count"] += 1
+                raise Task.DoesNotExist()
+            return Task(id=task_id)
+
+        with mock.patch.object(Task.objects, "get", side_effect=side_effect):
+            task = Task.objects.get_with_retry(
+                task_id, max_retries=5, delay_seconds=0.01
+            )
+
+        assert task.id == task_id
+        assert call_counter["count"] == 2
+
+    def test_get_with_retry_fail(self):
+        non_existent_id = uuid.uuid4()
+
+        with mock.patch.object(Task.objects, "get", side_effect=Task.DoesNotExist):
+            with pytest.raises(Task.DoesNotExist) as excinfo:
+                Task.objects.get_with_retry(
+                    non_existent_id, max_retries=3, delay_seconds=0.01
+                )
+
+        assert str(non_existent_id) in str(excinfo.value)

api/src/backend/api/tests/test_views.py

@@ -13,11 +13,12 @@ from botocore.exceptions import ClientError, NoCredentialsError
 from conftest import API_JSON_CONTENT_TYPE, TEST_PASSWORD, TEST_USER
 from django.conf import settings
 from django.urls import reverse
+from django_celery_results.models import TaskResult
 from rest_framework import status
+from rest_framework.response import Response
 
 from api.compliance import get_compliance_frameworks
 from api.models import (
-    ComplianceOverview,
     Integration,
     Invitation,
     Membership,
@@ -34,6 +35,7 @@ from api.models import (
     UserRoleRelationship,
 )
 from api.rls import Tenant
+from api.v1.views import ComplianceOverviewViewSet
 
 TODAY = str(datetime.today().date())
 
@@ -913,6 +915,16 @@ class TestProviderViewSet:
                     "uid": "gke_aaaa-dev_europe-test1_dev-aaaa-test-cluster-long-name-123456789",
                     "alias": "GKE",
                 },
+                {
+                    "provider": "kubernetes",
+                    "uid": "gke_project/cluster-name",
+                    "alias": "GKE",
+                },
+                {
+                    "provider": "kubernetes",
+                    "uid": "admin@k8s-demo",
+                    "alias": "test",
+                },
                 {
                     "provider": "azure",
                     "uid": "8851db6b-42e5-4533-aa9e-30a32d67e875",
@@ -920,7 +932,7 @@ class TestProviderViewSet:
                 },
                 {
                     "provider": "m365",
-                    "uid": "TestingPro.onMirosoft.com",
+                    "uid": "TestingPro.onmicrosoft.com",
                     "alias": "test",
                 },
                 {
@@ -1678,6 +1690,26 @@ class TestProviderSecretViewSet:
                     "refresh_token": "refresh-token",
                 },
             ),
+            # GCP with Service Account Key secret
+            (
+                Provider.ProviderChoices.GCP.value,
+                ProviderSecret.TypeChoices.SERVICE_ACCOUNT,
+                {
+                    "service_account_key": {
+                        "type": "service_account",
+                        "project_id": "project-id",
+                        "private_key_id": "private-key-id",
+                        "private_key": "private-key",
+                        "client_email": "client-email",
+                        "client_id": "client-id",
+                        "auth_uri": "auth-uri",
+                        "token_uri": "token-uri",
+                        "auth_provider_x509_cert_url": "auth-provider-x509-cert-url",
+                        "client_x509_cert_url": "client-x509-cert-url",
+                        "universe_domain": "universe-domain",
+                    },
+                },
+            ),
             # Kubernetes with STATIC secret
             (
                 Provider.ProviderChoices.KUBERNETES.value,
@@ -2303,7 +2335,10 @@ class TestScanViewSet:
         url = reverse("scan-report", kwargs={"pk": scan.id})
         response = authenticated_client.get(url)
         assert response.status_code == status.HTTP_404_NOT_FOUND
-        assert response.json()["errors"]["detail"] == "The scan has no reports."
+        assert (
+            response.json()["errors"]["detail"]
+            == "The scan has no reports, or the report generation task has not started yet."
+        )
 
     def test_report_s3_no_credentials(
         self, authenticated_client, scans_fixture, monkeypatch
@@ -2371,7 +2406,7 @@ class TestScanViewSet:
     ):
         """
         When output_location is a local path and glob.glob returns an empty list,
-        the view should return HTTP 404 with detail "The scan has no reports."
+        the view should return HTTP 404 with detail "The scan has no reports, or the report generation task has not started yet."
         """
         scan = scans_fixture[0]
         scan.output_location = "/tmp/nonexistent_report_pattern.zip"
@@ -2383,7 +2418,10 @@ class TestScanViewSet:
         response = authenticated_client.get(url)
 
         assert response.status_code == 404
-        assert response.json()["errors"]["detail"] == "The scan has no reports."
+        assert (
+            response.json()["errors"]["detail"]
+            == "The scan has no reports, or the report generation task has not started yet."
+        )
 
     def test_report_local_file(self, authenticated_client, scans_fixture, monkeypatch):
         scan = scans_fixture[0]
@@ -2458,7 +2496,10 @@ class TestScanViewSet:
         url = reverse("scan-compliance", kwargs={"pk": scan.id, "name": framework})
         resp = authenticated_client.get(url)
         assert resp.status_code == status.HTTP_404_NOT_FOUND
-        assert resp.json()["errors"]["detail"] == "The scan has no reports."
+        assert (
+            resp.json()["errors"]["detail"]
+            == "The scan has no reports, or the report generation task has not started yet."
+        )
 
     def test_compliance_s3_no_credentials(
         self, authenticated_client, scans_fixture, monkeypatch
@@ -2600,6 +2641,36 @@ class TestScanViewSet:
 
         assert response.status_code == status.HTTP_404_NOT_FOUND
 
+    @patch("api.v1.views.TaskSerializer")
+    def test__get_task_status_finds_task_using_kwargs(
+        self, mock_task_serializer, authenticated_client, scans_fixture
+    ):
+        scan = scans_fixture[0]
+        scan.state = StateChoices.COMPLETED
+        scan.output_location = "dummy"
+        scan.save()
+
+        task_result = TaskResult.objects.create(
+            task_name="scan-report",
+            task_kwargs={"scan_id": str(scan.id)},
+        )
+
+        task = Task.objects.create(
+            tenant_id=scan.tenant_id,
+            task_runner_task=task_result,
+        )
+
+        mock_task_serializer.return_value.data = {
+            "id": str(task.id),
+            "state": StateChoices.EXECUTING,
+        }
+
+        url = reverse("scan-report", kwargs={"pk": scan.id})
+        response = authenticated_client.get(url)
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        assert response.data["id"] == str(task.id)
+
     @patch("api.v1.views.get_s3_client")
     @patch("api.v1.views.sentry_sdk.capture_exception")
     def test_compliance_list_objects_client_error(
@@ -2650,7 +2721,10 @@ class TestScanViewSet:
         response = authenticated_client.get(url)
 
         assert response.status_code == status.HTTP_404_NOT_FOUND
-        assert response.json()["errors"]["detail"] == "The scan has no reports."
+        assert (
+            response.json()["errors"]["detail"]
+            == "The scan has no reports, or the report generation task has not started yet."
+        )
 
     @patch("api.v1.views.get_s3_client")
     def test_report_s3_client_error_other(
@@ -4688,210 +4762,248 @@ class TestComplianceOverviewViewSet:
         assert len(response.json()["data"]) == 0
 
     def test_compliance_overview_list(
-        self, authenticated_client, compliance_overviews_fixture
+        self, authenticated_client, compliance_requirements_overviews_fixture
     ):
         # List compliance overviews with existing data
-        compliance_overview1, compliance_overview2 = compliance_overviews_fixture
-        scan_id = str(compliance_overview1.scan.id)
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
 
         response = authenticated_client.get(
             reverse("complianceoverview-list"),
             {"filter[scan_id]": scan_id},
         )
         assert response.status_code == status.HTTP_200_OK
-        assert (
-            len(response.json()["data"]) == 1
-        )  # Due to the custom get_queryset method, only one compliance_id
+        data = response.json()["data"]
+        assert len(data) == 2  # Two compliance frameworks
 
-    def test_compliance_overview_list_missing_scan_id(self, authenticated_client):
-        # Attempt to list compliance overviews without providing filter[scan_id]
-        response = authenticated_client.get(reverse("complianceoverview-list"))
+        # Check that we get aggregated data for each compliance framework
+        framework_ids = [item["id"] for item in data]
+        assert "aws_account_security_onboarding_aws" in framework_ids
+        assert "cis_1.4_aws" in framework_ids
+
+        # Check structure of response
+        for item in data:
+            assert "id" in item
+            assert "attributes" in item
+            attributes = item["attributes"]
+            assert "framework" in attributes
+            assert "version" in attributes
+            assert "requirements_passed" in attributes
+            assert "requirements_failed" in attributes
+            assert "requirements_manual" in attributes
+            assert "total_requirements" in attributes
+
+    def test_compliance_overview_metadata(
+        self, authenticated_client, compliance_requirements_overviews_fixture
+    ):
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-metadata"),
+            {"filter[scan_id]": scan_id},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert "attributes" in data
+        assert "regions" in data["attributes"]
+        assert isinstance(data["attributes"]["regions"], list)
+
+    def test_compliance_overview_requirements(
+        self, authenticated_client, compliance_requirements_overviews_fixture
+    ):
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
+        compliance_id = requirement_overview1.compliance_id
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-requirements"),
+            {
+                "filter[scan_id]": scan_id,
+                "filter[compliance_id]": compliance_id,
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert len(data) > 0
+
+        # Check structure of requirements response
+        for item in data:
+            assert "id" in item
+            assert "attributes" in item
+            attributes = item["attributes"]
+            assert "framework" in attributes
+            assert "version" in attributes
+            assert "description" in attributes
+            assert "status" in attributes
+
+    def test_compliance_overview_requirements_missing_scan_id(
+        self, authenticated_client
+    ):
+        response = authenticated_client.get(
+            reverse("complianceoverview-requirements"),
+            {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+        )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert response.json()["errors"][0]["source"]["pointer"] == "filter[scan_id]"
-        assert response.json()["errors"][0]["code"] == "required"
+
+    def test_compliance_overview_requirements_missing_compliance_id(
+        self, authenticated_client, compliance_requirements_overviews_fixture
+    ):
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-requirements"),
+            {"filter[scan_id]": scan_id},
+        )
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+    def test_compliance_overview_attributes(self, authenticated_client):
+        response = authenticated_client.get(
+            reverse("complianceoverview-attributes"),
+            {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert len(data) > 0
+
+        # Check structure of attributes response
+        for item in data:
+            assert "id" in item
+            assert "attributes" in item
+            attributes = item["attributes"]
+            assert "framework" in attributes
+            assert "version" in attributes
+            assert "description" in attributes
+            assert "attributes" in attributes
+            assert "metadata" in attributes["attributes"]
+            assert "check_ids" in attributes["attributes"]
+
+    def test_compliance_overview_attributes_missing_compliance_id(
+        self, authenticated_client
+    ):
+        response = authenticated_client.get(
+            reverse("complianceoverview-attributes"),
+        )
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+    def test_compliance_overview_task_management_integration(
+        self, authenticated_client, compliance_requirements_overviews_fixture
+    ):
+        """Test that task management mixin is properly integrated"""
+        from unittest.mock import patch
+
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
+
+        # Mock a running task
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_response = Response(
+                {"detail": "Task is running"}, status=status.HTTP_202_ACCEPTED
+            )
+            mock_task_response.return_value = mock_response
+
+            response = authenticated_client.get(
+                reverse("complianceoverview-list"),
+                {"filter[scan_id]": scan_id},
+            )
+            assert response.status_code == status.HTTP_202_ACCEPTED
+            mock_task_response.assert_called_once()
+
+    def test_compliance_overview_task_failed_exception(
+        self, authenticated_client, compliance_requirements_overviews_fixture
+    ):
+        """Test handling of TaskFailedException"""
+        from unittest.mock import patch
+
+        from api.exceptions import TaskFailedException
+
+        requirement_overview1 = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview1.scan.id)
+
+        # Mock a failed task
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_task_response.side_effect = TaskFailedException("Task failed")
+
+            response = authenticated_client.get(
+                reverse("complianceoverview-list"),
+                {"filter[scan_id]": scan_id},
+            )
+            assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR
+            assert "Task failed to generate compliance overview data" in str(
+                response.data
+            )
 
     @pytest.mark.parametrize(
-        "filter_name, filter_value, expected_count",
+        "filter_name, filter_value_attr, expected_count_min",
         [
-            ("compliance_id", "aws_account_security_onboarding_aws", 1),
-            ("compliance_id.icontains", "security_onboarding", 1),
-            ("framework", "AWS-Account-Security-Onboarding", 1),
-            ("framework.icontains", "security-onboarding", 1),
-            ("version", "1.0", 1),
-            ("version", "2.0", 0),
-            ("version.icontains", "0", 1),
-            ("region", "eu-west-1", 1),
-            ("region.icontains", "west-1", 1),
-            ("region.in", "eu-west-1,eu-west-2", 1),
-            ("inserted_at.date", "2024-01-01", 0),
-            ("inserted_at.date", TODAY, 1),
-            ("inserted_at.gte", "2024-01-01", 1),
+            ("scan_id", "scan.id", 1),
+            ("compliance_id", "compliance_id", 1),
+            ("framework", "framework", 1),
+            ("version", "version", 1),
+            ("region", "region", 1),
         ],
     )
     def test_compliance_overview_filters(
         self,
         authenticated_client,
-        compliance_overviews_fixture,
+        compliance_requirements_overviews_fixture,
         filter_name,
-        filter_value,
-        expected_count,
+        filter_value_attr,
+        expected_count_min,
     ):
-        # Test filtering compliance overviews
-        compliance_overview1 = compliance_overviews_fixture[0]
-        scan_id = str(compliance_overview1.scan.id)
+        requirement_overview = compliance_requirements_overviews_fixture[0]
+        scan_id = str(requirement_overview.scan.id)
+
+        filter_value = requirement_overview
+        for attr in filter_value_attr.split("."):
+            filter_value = getattr(filter_value, attr)
+
+        filter_value = str(filter_value)
+
+        query_params = {
+            "filter[scan_id]": scan_id,
+            f"filter[{filter_name}]": filter_value,
+        }
+
+        if filter_name == "scan_id":
+            query_params = {"filter[scan_id]": filter_value}
 
         response = authenticated_client.get(
             reverse("complianceoverview-list"),
-            {
-                "filter[scan_id]": scan_id,
-                f"filter[{filter_name}]": filter_value,
-            },
-        )
-        assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()["data"]) == expected_count
-
-    @pytest.mark.parametrize(
-        "filter_name",
-        ["invalid_filter", "unknown_field"],
-    )
-    def test_compliance_overview_filters_invalid(
-        self, authenticated_client, compliance_overviews_fixture, filter_name
-    ):
-        # Test handling of invalid filters
-        compliance_overview1 = compliance_overviews_fixture[0]
-        scan_id = str(compliance_overview1.scan.id)
-
-        response = authenticated_client.get(
-            reverse("complianceoverview-list"),
-            {
-                "filter[scan_id]": scan_id,
-                f"filter[{filter_name}]": "some_value",
-            },
-        )
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-
-    @pytest.mark.parametrize(
-        "sort_field",
-        ["inserted_at", "-inserted_at", "compliance_id", "-compliance_id"],
-    )
-    def test_compliance_overview_sort(
-        self, authenticated_client, compliance_overviews_fixture, sort_field
-    ):
-        # Test sorting compliance overviews
-        compliance_overview1 = compliance_overviews_fixture[0]
-        scan_id = str(compliance_overview1.scan.id)
-
-        response = authenticated_client.get(
-            reverse("complianceoverview-list"),
-            {
-                "filter[scan_id]": scan_id,
-                "sort": sort_field,
-            },
-        )
-        assert response.status_code == status.HTTP_200_OK
-
-    def test_compliance_overview_sort_invalid(
-        self, authenticated_client, compliance_overviews_fixture
-    ):
-        # Test handling of invalid sort parameters
-        compliance_overview1 = compliance_overviews_fixture[0]
-        scan_id = str(compliance_overview1.scan.id)
-
-        response = authenticated_client.get(
-            reverse("complianceoverview-list"),
-            {
-                "filter[scan_id]": scan_id,
-                "sort": "invalid_field",
-            },
-        )
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert response.json()["errors"][0]["code"] == "invalid"
-        assert "invalid sort parameter" in response.json()["errors"][0]["detail"]
-
-    def test_compliance_overview_retrieve(
-        self, authenticated_client, compliance_overviews_fixture
-    ):
-        # Retrieve a specific compliance overview
-        compliance_overview1 = compliance_overviews_fixture[0]
-
-        response = authenticated_client.get(
-            reverse(
-                "complianceoverview-detail",
-                kwargs={"pk": compliance_overview1.id},
-            ),
-        )
-        assert response.status_code == status.HTTP_200_OK
-        data = response.json()["data"]
-        assert data["id"] == str(compliance_overview1.id)
-        attributes = data["attributes"]
-        assert attributes["compliance_id"] == compliance_overview1.compliance_id
-        assert attributes["framework"] == compliance_overview1.framework
-        assert attributes["version"] == compliance_overview1.version
-        assert attributes["region"] == compliance_overview1.region
-        assert attributes["description"] == compliance_overview1.description
-        assert "requirements" in attributes
-
-    def test_compliance_overview_invalid_retrieve(self, authenticated_client):
-        # Attempt to retrieve a compliance overview with an invalid ID
-        response = authenticated_client.get(
-            reverse(
-                "complianceoverview-detail",
-                kwargs={"pk": "invalid-id"},
-            ),
-        )
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-
-    def test_compliance_overview_list_queryset(
-        self, authenticated_client, compliance_overviews_fixture
-    ):
-        compliance_overview1, compliance_overview2 = compliance_overviews_fixture
-        scan_id = str(compliance_overview1.scan.id)
-
-        response = authenticated_client.get(
-            reverse("complianceoverview-list"),
-            {"filter[scan_id]": scan_id},
-        )
-        # No filters, most fails should be returned
-        assert len(response.json()["data"]) == 1
-        assert response.json()["data"][0]["id"] == str(compliance_overview2.id)
-
-        compliance_overview1.requirements_failed = 5
-        compliance_overview1.save()
-
-        response = authenticated_client.get(
-            reverse("complianceoverview-list"),
-            {"filter[scan_id]": scan_id},
-        )
-        # No filters, now compliance_overview1 has more fails
-        assert len(response.json()["data"]) == 1
-        assert response.json()["data"][0]["id"] == str(compliance_overview1.id)
-
-    def test_compliance_overview_metadata(
-        self, authenticated_client, compliance_overviews_fixture
-    ):
-        response = authenticated_client.get(
-            reverse("complianceoverview-metadata"),
-            {"filter[scan_id]": str(compliance_overviews_fixture[0].scan_id)},
-        )
-        data = response.json()
-
-        expected_regions = set(
-            ComplianceOverview.objects.all()
-            .values_list("region", flat=True)
-            .distinct("region")
+            query_params,
         )
 
         assert response.status_code == status.HTTP_200_OK
-        assert data["data"]["type"] == "compliance-overviews-metadata"
-        assert data["data"]["id"] is None
-        assert set(data["data"]["attributes"]["regions"]) == expected_regions
+        response_data = response.json()
 
-    def test_compliance_overview_metadata_missing_scan_id(self, authenticated_client):
-        # Attempt to list compliance overviews without providing filter[scan_id]
-        response = authenticated_client.get(reverse("complianceoverview-metadata"))
-        assert response.status_code == status.HTTP_400_BAD_REQUEST
-        assert response.json()["errors"][0]["source"]["pointer"] == "filter[scan_id]"
-        assert response.json()["errors"][0]["code"] == "required"
+        assert len(response_data["data"]) >= expected_count_min
+
+        if response_data["data"]:
+            first_item = response_data["data"][0]
+            assert "id" in first_item
+            assert "type" in first_item
+            assert first_item["type"] == "compliance-overviews"
+            assert "attributes" in first_item
+
+            attributes = first_item["attributes"]
+            assert "framework" in attributes
+            assert "version" in attributes
+            assert "requirements_passed" in attributes
+            assert "requirements_failed" in attributes
+            assert "requirements_manual" in attributes
+            assert "total_requirements" in attributes
+
+            if filter_name == "compliance_id":
+                assert first_item["id"] == filter_value
+            elif filter_name == "framework":
+                assert attributes["framework"] == filter_value
+            elif filter_name == "version":
+                assert attributes["version"] == filter_value
 
 
 @pytest.mark.django_db

api/src/backend/api/v1/mixins.py

@@ -1,5 +1,16 @@
+from django.urls import reverse
+from django_celery_results.models import TaskResult
+from rest_framework import status
 from rest_framework.response import Response
 
+from api.exceptions import (
+    TaskFailedException,
+    TaskInProgressException,
+    TaskNotFoundException,
+)
+from api.models import StateChoices, Task
+from api.v1.serializers import TaskSerializer
+
 
 class PaginateByPkMixin:
     """
@@ -31,3 +42,181 @@ class PaginateByPkMixin:
 
         serialized = self.get_serializer(queryset, many=True).data
         return self.get_paginated_response(serialized)
+
+
+class TaskManagementMixin:
+    """
+    Mixin to manage task status checking.
+
+    This mixin provides functionality to check if a task with specific parameters
+    is running, completed, failed, or doesn't exist. It returns the task when running
+    and raises specific exceptions for failed/not found scenarios that can be handled
+    at the view level.
+    """
+
+    def check_task_status(
+        self,
+        task_name: str,
+        task_kwargs: dict,
+        raise_on_failed: bool = True,
+        raise_on_not_found: bool = True,
+    ) -> Task | None:
+        """
+        Check the status of a task with given name and kwargs.
+
+        This method first checks for a related Task object, and if not found,
+        checks TaskResult directly. If a TaskResult is found and running but
+        there's no related Task, it raises TaskInProgressException.
+
+        Args:
+            task_name (str): The name of the task to check
+            task_kwargs (dict): The kwargs to match against the task
+            raise_on_failed (bool): Whether to raise exception if task failed
+            raise_on_not_found (bool): Whether to raise exception if task not found
+
+        Returns:
+            Task | None: The task instance if found (regardless of state), None if not found and raise_on_not_found=False
+
+        Raises:
+            TaskFailedException: If task failed and raise_on_failed=True
+            TaskNotFoundException: If task not found and raise_on_not_found=True
+            TaskInProgressException: If task is running but no related Task object exists
+        """
+        # First, try to find a Task object with related TaskResult
+        try:
+            # Build the filter for task kwargs
+            task_filter = {
+                "task_runner_task__task_name": task_name,
+            }
+
+            # Add kwargs filters - we need to check if the task kwargs contain our parameters
+            for key, value in task_kwargs.items():
+                task_filter["task_runner_task__task_kwargs__contains"] = str(value)
+
+            task = (
+                Task.objects.filter(**task_filter)
+                .select_related("task_runner_task")
+                .order_by("-inserted_at")
+                .first()
+            )
+
+            if task:
+                # Get task state using the same logic as TaskSerializer
+                task_state_mapping = {
+                    "PENDING": StateChoices.AVAILABLE,
+                    "STARTED": StateChoices.EXECUTING,
+                    "PROGRESS": StateChoices.EXECUTING,
+                    "SUCCESS": StateChoices.COMPLETED,
+                    "FAILURE": StateChoices.FAILED,
+                    "REVOKED": StateChoices.CANCELLED,
+                }
+
+                celery_status = (
+                    task.task_runner_task.status if task.task_runner_task else None
+                )
+                task_state = task_state_mapping.get(
+                    celery_status or "", StateChoices.AVAILABLE
+                )
+
+                # Check task state and raise exceptions accordingly
+                if task_state in (StateChoices.FAILED, StateChoices.CANCELLED):
+                    if raise_on_failed:
+                        raise TaskFailedException(task=task)
+                    return task
+                elif task_state == StateChoices.COMPLETED:
+                    return None
+
+                return task
+
+        except Task.DoesNotExist:
+            pass
+
+        # If no Task found, check TaskResult directly
+        try:
+            # Build the filter for TaskResult
+            task_result_filter = {
+                "task_name": task_name,
+            }
+
+            # Add kwargs filters - check if the task kwargs contain our parameters
+            for key, value in task_kwargs.items():
+                task_result_filter["task_kwargs__contains"] = str(value)
+
+            task_result = (
+                TaskResult.objects.filter(**task_result_filter)
+                .order_by("-date_created")
+                .first()
+            )
+
+            if task_result:
+                # Check if the TaskResult indicates a running task
+                if task_result.status in ["PENDING", "STARTED", "PROGRESS"]:
+                    # Task is running but no related Task object exists
+                    raise TaskInProgressException(task_result=task_result)
+                elif task_result.status == "FAILURE":
+                    if raise_on_failed:
+                        raise TaskFailedException(task=None)
+                # For other statuses (SUCCESS, REVOKED), we don't have a Task to return,
+                # so we treat it as not found
+
+        except TaskResult.DoesNotExist:
+            pass
+
+        # No task found at all
+        if raise_on_not_found:
+            raise TaskNotFoundException()
+        return None
+
+    def get_task_response_if_running(
+        self,
+        task_name: str,
+        task_kwargs: dict,
+        raise_on_failed: bool = True,
+        raise_on_not_found: bool = True,
+    ) -> Response | None:
+        """
+        Get a 202 response with task details if the task is currently running.
+
+        This method is useful for endpoints that should return task status when
+        a background task is in progress, similar to the compliance overview endpoints.
+
+        Args:
+            task_name (str): The name of the task to check
+            task_kwargs (dict): The kwargs to match against the task
+
+        Returns:
+            Response | None: 202 response with task details if running, None otherwise
+        """
+        task = self.check_task_status(
+            task_name=task_name,
+            task_kwargs=task_kwargs,
+            raise_on_failed=raise_on_failed,
+            raise_on_not_found=raise_on_not_found,
+        )
+
+        if not task:
+            return None
+
+        # Get task state
+        task_state_mapping = {
+            "PENDING": StateChoices.AVAILABLE,
+            "STARTED": StateChoices.EXECUTING,
+            "PROGRESS": StateChoices.EXECUTING,
+            "SUCCESS": StateChoices.COMPLETED,
+            "FAILURE": StateChoices.FAILED,
+            "REVOKED": StateChoices.CANCELLED,
+        }
+
+        celery_status = task.task_runner_task.status if task.task_runner_task else None
+        task_state = task_state_mapping.get(celery_status or "", StateChoices.AVAILABLE)
+
+        if task_state == StateChoices.EXECUTING:
+            self.response_serializer_class = TaskSerializer
+            serializer = TaskSerializer(task)
+            return Response(
+                data=serializer.data,
+                status=status.HTTP_202_ACCEPTED,
+                headers={
+                    "Content-Location": reverse("task-detail", kwargs={"pk": task.id})
+                },
+            )

api/src/backend/api/v1/serializer_utils/providers.py

@@ -119,9 +119,9 @@ from rest_framework_json_api import serializers
                         "type": "email",
                         "description": "User microsoft email address.",
                     },
-                    "encrypted_password": {
+                    "password": {
                         "type": "string",
-                        "description": "User encrypted password.",
+                        "description": "User password.",
                     },
                 },
                 "required": [
@@ -129,7 +129,7 @@ from rest_framework_json_api import serializers
                     "client_secret",
                     "tenant_id",
                     "user",
-                    "encrypted_password",
+                    "password",
                 ],
             },
             {
@@ -154,6 +154,17 @@ from rest_framework_json_api import serializers
                 },
                 "required": ["client_id", "client_secret", "refresh_token"],
             },
+            {
+                "type": "object",
+                "title": "GCP Service Account Key",
+                "properties": {
+                    "service_account_key": {
+                        "type": "object",
+                        "description": "The service account key for GCP.",
+                    }
+                },
+                "required": ["service_account_key"],
+            },
             {
                 "type": "object",
                 "title": "Kubernetes Static Credentials",

api/src/backend/api/v1/serializers.py

@@ -14,7 +14,6 @@ from rest_framework_simplejwt.serializers import TokenObtainPairSerializer
 from rest_framework_simplejwt.tokens import RefreshToken
 
 from api.models import (
-    ComplianceOverview,
     Finding,
     Integration,
     IntegrationProviderRelationship,
@@ -31,6 +30,7 @@ from api.models import (
     RoleProviderGroupRelationship,
     Scan,
     StateChoices,
+    StatusChoices,
     Task,
     User,
     UserRoleRelationship,
@@ -1159,6 +1159,8 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
                 )
         elif secret_type == ProviderSecret.TypeChoices.ROLE:
             serializer = AWSRoleAssumptionProviderSecret(data=secret)
+        elif secret_type == ProviderSecret.TypeChoices.SERVICE_ACCOUNT:
+            serializer = GCPServiceAccountProviderSecret(data=secret)
         else:
             raise serializers.ValidationError(
                 {"secret_type": f"Secret type not supported: {secret_type}"}
@@ -1197,7 +1199,7 @@ class M365ProviderSecret(serializers.Serializer):
     client_secret = serializers.CharField()
     tenant_id = serializers.CharField()
     user = serializers.EmailField()
-    encrypted_password = serializers.CharField()
+    password = serializers.CharField()
 
     class Meta:
         resource_name = "provider-secrets"
@@ -1212,6 +1214,13 @@ class GCPProviderSecret(serializers.Serializer):
         resource_name = "provider-secrets"
 
 
+class GCPServiceAccountProviderSecret(serializers.Serializer):
+    service_account_key = serializers.JSONField()
+
+    class Meta:
+        resource_name = "provider-secrets"
+
+
 class KubernetesProviderSecret(serializers.Serializer):
     kubeconfig_content = serializers.CharField()
 
@@ -1670,130 +1679,61 @@ class RoleProviderGroupRelationshipSerializer(RLSSerializer, BaseWriteSerializer
 # Compliance overview
 
 
-class ComplianceOverviewSerializer(RLSSerializer):
+class ComplianceOverviewSerializer(serializers.Serializer):
     """
-    Serializer for the ComplianceOverview model.
+    Serializer for compliance requirement status aggregated by compliance framework.
+
+    This serializer is used to format aggregated compliance framework data,
+    providing counts of passed, failed, and manual requirements along with
+    an overall global status for each framework.
     """
 
-    requirements_status = serializers.SerializerMethodField(
-        read_only=True, method_name="get_requirements_status"
-    )
-    provider_type = serializers.SerializerMethodField(read_only=True)
+    # Add ID field which will be used for resource identification
+    id = serializers.CharField()
+    framework = serializers.CharField()
+    version = serializers.CharField()
+    requirements_passed = serializers.IntegerField()
+    requirements_failed = serializers.IntegerField()
+    requirements_manual = serializers.IntegerField()
+    total_requirements = serializers.IntegerField()
 
-    class Meta:
-        model = ComplianceOverview
-        fields = [
-            "id",
-            "inserted_at",
-            "compliance_id",
-            "framework",
-            "version",
-            "requirements_status",
-            "region",
-            "provider_type",
-            "scan",
-            "url",
-        ]
-
-    @extend_schema_field(
-        {
-            "type": "object",
-            "properties": {
-                "passed": {"type": "integer"},
-                "failed": {"type": "integer"},
-                "manual": {"type": "integer"},
-                "total": {"type": "integer"},
-            },
-        }
-    )
-    def get_requirements_status(self, obj):
-        return {
-            "passed": obj.requirements_passed,
-            "failed": obj.requirements_failed,
-            "manual": obj.requirements_manual,
-            "total": obj.total_requirements,
-        }
-
-    @extend_schema_field(serializers.CharField(allow_null=True))
-    def get_provider_type(self, obj):
-        """
-        Retrieves the provider_type from scan.provider.provider_type.
-        """
-        try:
-            return obj.scan.provider.provider
-        except AttributeError:
-            return None
+    class JSONAPIMeta:
+        resource_name = "compliance-overviews"
 
 
-class ComplianceOverviewFullSerializer(ComplianceOverviewSerializer):
-    requirements = serializers.SerializerMethodField(read_only=True)
+class ComplianceOverviewDetailSerializer(serializers.Serializer):
+    """
+    Serializer for detailed compliance requirement information.
 
-    class Meta(ComplianceOverviewSerializer.Meta):
-        fields = ComplianceOverviewSerializer.Meta.fields + [
-            "description",
-            "requirements",
-        ]
+    This serializer formats the aggregated requirement data, showing detailed status
+    and counts for each requirement across all regions.
+    """
 
-    @extend_schema_field(
-        {
-            "type": "object",
-            "properties": {
-                "requirement_id": {
-                    "type": "object",
-                    "properties": {
-                        "name": {"type": "string"},
-                        "checks": {
-                            "type": "object",
-                            "properties": {
-                                "check_name": {
-                                    "type": "object",
-                                    "properties": {
-                                        "status": {
-                                            "type": "string",
-                                            "enum": ["PASS", "FAIL", None],
-                                        },
-                                    },
-                                }
-                            },
-                            "description": "Each key in the 'checks' object is a check name, with values as "
-                            "'PASS', 'FAIL', or null.",
-                        },
-                        "status": {
-                            "type": "string",
-                            "enum": ["PASS", "FAIL", "MANUAL"],
-                        },
-                        "attributes": {
-                            "type": "array",
-                            "items": {
-                                "type": "object",
-                            },
-                        },
-                        "description": {"type": "string"},
-                        "checks_status": {
-                            "type": "object",
-                            "properties": {
-                                "total": {"type": "integer"},
-                                "pass": {"type": "integer"},
-                                "fail": {"type": "integer"},
-                                "manual": {"type": "integer"},
-                            },
-                        },
-                    },
-                }
-            },
-        }
-    )
-    def get_requirements(self, obj):
-        """
-        Returns the detailed structure of requirements.
-        """
-        return obj.requirements
+    id = serializers.CharField()
+    framework = serializers.CharField()
+    version = serializers.CharField()
+    description = serializers.CharField()
+    status = serializers.ChoiceField(choices=StatusChoices.choices)
+
+    class JSONAPIMeta:
+        resource_name = "compliance-requirements-details"
+
+
+class ComplianceOverviewAttributesSerializer(serializers.Serializer):
+    id = serializers.CharField()
+    framework = serializers.CharField()
+    version = serializers.CharField()
+    description = serializers.CharField()
+    attributes = serializers.JSONField()
+
+    class JSONAPIMeta:
+        resource_name = "compliance-requirements-attributes"
 
 
 class ComplianceOverviewMetadataSerializer(serializers.Serializer):
     regions = serializers.ListField(child=serializers.CharField(), allow_empty=True)
 
-    class Meta:
+    class JSONAPIMeta:
         resource_name = "compliance-overviews-metadata"
 
 

api/src/backend/api/v1/views.py

@@ -17,7 +17,7 @@ from django.conf import settings as django_settings
 from django.contrib.postgres.aggregates import ArrayAgg
 from django.contrib.postgres.search import SearchQuery
 from django.db import transaction
-from django.db.models import Count, Exists, F, OuterRef, Prefetch, Q, Subquery, Sum
+from django.db.models import Count, Exists, F, OuterRef, Prefetch, Q, Sum
 from django.db.models.functions import Coalesce
 from django.http import HttpResponse
 from django.urls import reverse
@@ -26,10 +26,10 @@ from django.utils.decorators import method_decorator
 from django.views.decorators.cache import cache_control
 from django_celery_beat.models import PeriodicTask
 from drf_spectacular.settings import spectacular_settings
+from drf_spectacular.types import OpenApiTypes
 from drf_spectacular.utils import (
     OpenApiParameter,
     OpenApiResponse,
-    OpenApiTypes,
     extend_schema,
     extend_schema_view,
 )
@@ -58,8 +58,12 @@ from tasks.tasks import (
 )
 
 from api.base_views import BaseRLSViewSet, BaseTenantViewset, BaseUserViewset
-from api.compliance import get_compliance_frameworks
+from api.compliance import (
+    PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE,
+    get_compliance_frameworks,
+)
 from api.db_router import MainRouter
+from api.exceptions import TaskFailedException
 from api.filters import (
     ComplianceOverviewFilter,
     FindingFilter,
@@ -81,6 +85,7 @@ from api.filters import (
 )
 from api.models import (
     ComplianceOverview,
+    ComplianceRequirementOverview,
     Finding,
     Integration,
     Invitation,
@@ -111,9 +116,10 @@ from api.utils import (
     validate_invitation,
 )
 from api.uuid_utils import datetime_to_uuid7, uuid7_start
-from api.v1.mixins import PaginateByPkMixin
+from api.v1.mixins import PaginateByPkMixin, TaskManagementMixin
 from api.v1.serializers import (
-    ComplianceOverviewFullSerializer,
+    ComplianceOverviewAttributesSerializer,
+    ComplianceOverviewDetailSerializer,
     ComplianceOverviewMetadataSerializer,
     ComplianceOverviewSerializer,
     FindingDynamicFilterSerializer,
@@ -260,7 +266,7 @@ class SchemaView(SpectacularAPIView):
 
     def get(self, request, *args, **kwargs):
         spectacular_settings.TITLE = "Prowler API"
-        spectacular_settings.VERSION = "1.8.1"
+        spectacular_settings.VERSION = "1.9.0"
         spectacular_settings.DESCRIPTION = (
             "Prowler API specification.\n\nThis file is auto-generated."
         )
@@ -1086,7 +1092,7 @@ class ProviderViewSet(BaseRLSViewSet):
             task = check_provider_connection_task.delay(
                 provider_id=pk, tenant_id=self.request.tenant_id
             )
-        prowler_task = Task.objects.get(id=task.id)
+        prowler_task = Task.objects.get_with_retry(id=task.id)
         serializer = TaskSerializer(prowler_task)
         return Response(
             data=serializer.data,
@@ -1109,7 +1115,7 @@ class ProviderViewSet(BaseRLSViewSet):
             task = delete_provider_task.delay(
                 provider_id=pk, tenant_id=self.request.tenant_id
             )
-        prowler_task = Task.objects.get(id=task.id)
+        prowler_task = Task.objects.get_with_retry(id=task.id)
         serializer = TaskSerializer(prowler_task)
         return Response(
             data=serializer.data,
@@ -1160,7 +1166,9 @@ class ProviderViewSet(BaseRLSViewSet):
             200: OpenApiResponse(description="Report obtained successfully"),
             202: OpenApiResponse(description="The task is in progress"),
             403: OpenApiResponse(description="There is a problem with credentials"),
-            404: OpenApiResponse(description="The scan has no reports"),
+            404: OpenApiResponse(
+                description="The scan has no reports, or the report generation task has not started yet"
+            ),
         },
     ),
     compliance=extend_schema(
@@ -1281,7 +1289,7 @@ class ScanViewSet(BaseRLSViewSet):
             try:
                 task = Task.objects.get(
                     task_runner_task__task_name="scan-report",
-                    task_runner_task__task_args__contains=str(scan_instance.id),
+                    task_runner_task__task_kwargs__contains=str(scan_instance.id),
                 )
             except Task.DoesNotExist:
                 return None
@@ -1363,7 +1371,9 @@ class ScanViewSet(BaseRLSViewSet):
                 code = e.response.get("Error", {}).get("Code")
                 if code == "NoSuchKey":
                     return Response(
-                        {"detail": "The scan has no reports."},
+                        {
+                            "detail": "The scan has no reports, or the report generation task has not started yet."
+                        },
                         status=status.HTTP_404_NOT_FOUND,
                     )
                 return Response(
@@ -1376,7 +1386,9 @@ class ScanViewSet(BaseRLSViewSet):
             files = glob.glob(path_pattern)
             if not files:
                 return Response(
-                    {"detail": "The scan has no reports."},
+                    {
+                        "detail": "The scan has no reports, or the report generation task has not started yet."
+                    },
                     status=status.HTTP_404_NOT_FOUND,
                 )
             filepath = files[0]
@@ -1402,7 +1414,10 @@ class ScanViewSet(BaseRLSViewSet):
 
         if not scan.output_location:
             return Response(
-                {"detail": "The scan has no reports."}, status=status.HTTP_404_NOT_FOUND
+                {
+                    "detail": "The scan has no reports, or the report generation task has not started yet."
+                },
+                status=status.HTTP_404_NOT_FOUND,
             )
 
         if scan.output_location.startswith("s3://"):
@@ -1440,7 +1455,10 @@ class ScanViewSet(BaseRLSViewSet):
 
         if not scan.output_location:
             return Response(
-                {"detail": "The scan has no reports."}, status=status.HTTP_404_NOT_FOUND
+                {
+                    "detail": "The scan has no reports, or the report generation task has not started yet."
+                },
+                status=status.HTTP_404_NOT_FOUND,
             )
 
         if scan.output_location.startswith("s3://"):
@@ -1477,10 +1495,10 @@ class ScanViewSet(BaseRLSViewSet):
                 },
             )
 
+        prowler_task = Task.objects.get_with_retry(id=task.id)
         scan.task_id = task.id
         scan.save(update_fields=["task_id"])
 
-        prowler_task = Task.objects.get(id=task.id)
         self.response_serializer_class = TaskSerializer
         output_serializer = self.get_serializer(prowler_task)
 
@@ -2379,8 +2397,7 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
     list=extend_schema(
         tags=["Compliance Overview"],
         summary="List compliance overviews for a scan",
-        description="Retrieve an overview of all the compliance in a given scan. If no region filters are provided, the"
-        " region with the most fails will be returned by default.",
+        description="Retrieve an overview of all the compliance in a given scan.",
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
@@ -2390,12 +2407,18 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Related scan ID.",
             ),
         ],
-    ),
-    retrieve=extend_schema(
-        tags=["Compliance Overview"],
-        summary="Retrieve data from a specific compliance overview",
-        description="Fetch detailed information about a specific compliance overview by its ID, including detailed "
-        "requirement information and check's status.",
+        responses={
+            200: OpenApiResponse(
+                description="Compliance overviews obtained successfully",
+                response=ComplianceOverviewSerializer(many=True),
+            ),
+            202: OpenApiResponse(
+                description="The task is in progress", response=TaskSerializer
+            ),
+            500: OpenApiResponse(
+                description="Compliance overviews generation task failed"
+            ),
+        },
     ),
     metadata=extend_schema(
         tags=["Compliance Overview"],
@@ -2411,19 +2434,84 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Related scan ID.",
             ),
         ],
+        responses={
+            200: OpenApiResponse(
+                description="Compliance overviews metadata obtained successfully",
+                response=ComplianceOverviewMetadataSerializer,
+            ),
+            202: OpenApiResponse(description="The task is in progress"),
+            500: OpenApiResponse(
+                description="Compliance overviews generation task failed"
+            ),
+        },
+    ),
+    requirements=extend_schema(
+        tags=["Compliance Overview"],
+        summary="List compliance requirements overview for a scan",
+        description="Retrieve a detailed overview of compliance requirements in a given scan, grouped by compliance "
+        "framework. This endpoint provides requirement-level details and aggregates status across regions.",
+        parameters=[
+            OpenApiParameter(
+                name="filter[scan_id]",
+                required=True,
+                type=OpenApiTypes.UUID,
+                location=OpenApiParameter.QUERY,
+                description="Related scan ID.",
+            ),
+            OpenApiParameter(
+                name="filter[compliance_id]",
+                required=True,
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Compliance ID.",
+            ),
+        ],
+        responses={
+            200: OpenApiResponse(
+                description="Compliance requirement details obtained successfully",
+                response=ComplianceOverviewDetailSerializer(many=True),
+            ),
+            202: OpenApiResponse(description="The task is in progress"),
+            500: OpenApiResponse(
+                description="Compliance overviews generation task failed"
+            ),
+        },
+        filters=True,
+    ),
+    attributes=extend_schema(
+        tags=["Compliance Overview"],
+        summary="Get compliance requirement attributes",
+        description="Retrieve detailed attribute information for all requirements in a specific compliance framework "
+        "along with the associated check IDs for each requirement.",
+        parameters=[
+            OpenApiParameter(
+                name="filter[compliance_id]",
+                required=True,
+                type=str,
+                location=OpenApiParameter.QUERY,
+                description="Compliance framework ID to get attributes for.",
+            ),
+        ],
+        responses={
+            200: OpenApiResponse(
+                description="Compliance attributes obtained successfully",
+                response=ComplianceOverviewAttributesSerializer(many=True),
+            ),
+        },
     ),
 )
 @method_decorator(CACHE_DECORATOR, name="list")
-@method_decorator(CACHE_DECORATOR, name="retrieve")
-class ComplianceOverviewViewSet(BaseRLSViewSet):
+@method_decorator(CACHE_DECORATOR, name="requirements")
+@method_decorator(CACHE_DECORATOR, name="attributes")
+class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     pagination_class = ComplianceOverviewPagination
-    queryset = ComplianceOverview.objects.all()
+    queryset = ComplianceRequirementOverview.objects.all()
     serializer_class = ComplianceOverviewSerializer
     filterset_class = ComplianceOverviewFilter
     http_method_names = ["get"]
     search_fields = ["compliance_id"]
     ordering = ["compliance_id"]
-    ordering_fields = ["inserted_at", "compliance_id", "framework", "region"]
+    ordering_fields = ["compliance_id"]
     # RBAC required permissions (implicit -> MANAGE_PROVIDERS enable unlimited visibility or check the visibility of
     # the provider through the provider group)
     required_permissions = []
@@ -2434,51 +2522,44 @@ class ComplianceOverviewViewSet(BaseRLSViewSet):
             role, Permissions.UNLIMITED_VISIBILITY.value, False
         )
 
-        if self.action == "retrieve":
-            if unlimited_visibility:
-                # User has unlimited visibility, return all compliance
-                return ComplianceOverview.objects.filter(
-                    tenant_id=self.request.tenant_id
-                )
-
-            providers = get_providers(role)
-            return ComplianceOverview.objects.filter(
-                tenant_id=self.request.tenant_id, scan__provider__in=providers
-            )
-
         if unlimited_visibility:
             base_queryset = self.filter_queryset(
-                ComplianceOverview.objects.filter(tenant_id=self.request.tenant_id)
+                ComplianceRequirementOverview.objects.filter(
+                    tenant_id=self.request.tenant_id
+                )
             )
         else:
             providers = Provider.objects.filter(
                 provider_groups__in=role.provider_groups.all()
             ).distinct()
             base_queryset = self.filter_queryset(
-                ComplianceOverview.objects.filter(
+                ComplianceRequirementOverview.objects.filter(
                     tenant_id=self.request.tenant_id, scan__provider__in=providers
                 )
             )
 
-        max_failed_ids = (
-            base_queryset.filter(compliance_id=OuterRef("compliance_id"))
-            .order_by("-requirements_failed")
-            .values("id")[:1]
-        )
-
-        return base_queryset.filter(id__in=Subquery(max_failed_ids)).order_by(
-            "compliance_id"
-        )
+        return base_queryset
 
     def get_serializer_class(self):
-        if self.action == "retrieve":
-            return ComplianceOverviewFullSerializer
+        if hasattr(self, "response_serializer_class"):
+            return self.response_serializer_class
+        elif self.action == "list":
+            return ComplianceOverviewSerializer
         elif self.action == "metadata":
             return ComplianceOverviewMetadataSerializer
+        elif self.action == "attributes":
+            return ComplianceOverviewAttributesSerializer
+        elif self.action == "requirements":
+            return ComplianceOverviewDetailSerializer
         return super().get_serializer_class()
 
+    @extend_schema(exclude=True)
+    def retrieve(self, request, *args, **kwargs):
+        raise MethodNotAllowed(method="GET")
+
     def list(self, request, *args, **kwargs):
-        if not request.query_params.get("filter[scan_id]"):
+        scan_id = request.query_params.get("filter[scan_id]")
+        if not scan_id:
             raise ValidationError(
                 [
                     {
@@ -2489,7 +2570,82 @@ class ComplianceOverviewViewSet(BaseRLSViewSet):
                     }
                 ]
             )
-        return super().list(request, *args, **kwargs)
+        try:
+            if task := self.get_task_response_if_running(
+                task_name="scan-compliance-overviews",
+                task_kwargs={"tenant_id": self.request.tenant_id, "scan_id": scan_id},
+                raise_on_not_found=False,
+            ):
+                return task
+        except TaskFailedException:
+            return Response(
+                {"detail": "Task failed to generate compliance overview data."},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+        queryset = self.filter_queryset(self.filter_queryset(self.get_queryset()))
+
+        requirement_status_subquery = queryset.values(
+            "compliance_id", "requirement_id"
+        ).annotate(
+            fail_count=Count("id", filter=Q(requirement_status="FAIL")),
+            pass_count=Count("id", filter=Q(requirement_status="PASS")),
+            total_count=Count("id"),
+        )
+
+        compliance_data = {}
+        framework_info = {}
+
+        for item in queryset.values("compliance_id", "framework", "version").distinct():
+            framework_info[item["compliance_id"]] = {
+                "framework": item["framework"],
+                "version": item["version"],
+            }
+
+        for item in requirement_status_subquery:
+            compliance_id = item["compliance_id"]
+
+            if item["fail_count"] > 0:
+                req_status = "FAIL"
+            elif item["pass_count"] == item["total_count"]:
+                req_status = "PASS"
+            else:
+                req_status = "MANUAL"
+
+            if compliance_id not in compliance_data:
+                compliance_data[compliance_id] = {
+                    "total_requirements": 0,
+                    "requirements_passed": 0,
+                    "requirements_failed": 0,
+                    "requirements_manual": 0,
+                }
+
+            compliance_data[compliance_id]["total_requirements"] += 1
+            if req_status == "PASS":
+                compliance_data[compliance_id]["requirements_passed"] += 1
+            elif req_status == "FAIL":
+                compliance_data[compliance_id]["requirements_failed"] += 1
+            else:
+                compliance_data[compliance_id]["requirements_manual"] += 1
+
+        response_data = []
+        for compliance_id, data in compliance_data.items():
+            framework = framework_info.get(compliance_id, {})
+
+            response_data.append(
+                {
+                    "id": compliance_id,
+                    "compliance_id": compliance_id,
+                    "framework": framework.get("framework", ""),
+                    "version": framework.get("version", ""),
+                    "requirements_passed": data["requirements_passed"],
+                    "requirements_failed": data["requirements_failed"],
+                    "requirements_manual": data["requirements_manual"],
+                    "total_requirements": data["total_requirements"],
+                }
+            )
+
+        serializer = self.get_serializer(response_data, many=True)
+        return Response(serializer.data)
 
     @action(detail=False, methods=["get"], url_name="metadata")
     def metadata(self, request):
@@ -2505,11 +2661,21 @@ class ComplianceOverviewViewSet(BaseRLSViewSet):
                     }
                 ]
             )
-
-        tenant_id = self.request.tenant_id
-
+        try:
+            if task := self.get_task_response_if_running(
+                task_name="scan-compliance-overviews",
+                task_kwargs={"tenant_id": self.request.tenant_id, "scan_id": scan_id},
+                raise_on_not_found=False,
+            ):
+                return task
+        except TaskFailedException:
+            return Response(
+                {"detail": "Task failed to generate compliance overview data."},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
         regions = list(
-            ComplianceOverview.objects.filter(tenant_id=tenant_id, scan_id=scan_id)
+            self.get_queryset()
+            .filter(scan_id=scan_id)
             .values_list("region", flat=True)
             .order_by("region")
             .distinct()
@@ -2520,6 +2686,152 @@ class ComplianceOverviewViewSet(BaseRLSViewSet):
         serializer.is_valid(raise_exception=True)
         return Response(serializer.data, status=status.HTTP_200_OK)
 
+    @action(detail=False, methods=["get"], url_name="requirements")
+    def requirements(self, request):
+        scan_id = request.query_params.get("filter[scan_id]")
+        compliance_id = request.query_params.get("filter[compliance_id]")
+
+        if not scan_id:
+            raise ValidationError(
+                [
+                    {
+                        "detail": "This query parameter is required.",
+                        "status": 400,
+                        "source": {"pointer": "filter[scan_id]"},
+                        "code": "required",
+                    }
+                ]
+            )
+
+        if not compliance_id:
+            raise ValidationError(
+                [
+                    {
+                        "detail": "This query parameter is required.",
+                        "status": 400,
+                        "source": {"pointer": "filter[compliance_id]"},
+                        "code": "required",
+                    }
+                ]
+            )
+        try:
+            if task := self.get_task_response_if_running(
+                task_name="scan-compliance-overviews",
+                task_kwargs={"tenant_id": self.request.tenant_id, "scan_id": scan_id},
+                raise_on_not_found=False,
+            ):
+                return task
+        except TaskFailedException:
+            return Response(
+                {"detail": "Task failed to generate compliance overview data."},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
+        filtered_queryset = self.filter_queryset(self.get_queryset())
+
+        all_requirements = (
+            filtered_queryset.values(
+                "requirement_id", "framework", "version", "description"
+            )
+            .distinct()
+            .annotate(total_instances=Count("id"))
+        )
+
+        passed_instances = (
+            filtered_queryset.filter(requirement_status="PASS")
+            .values("requirement_id")
+            .annotate(pass_count=Count("id"))
+        )
+
+        passed_counts = {
+            item["requirement_id"]: item["pass_count"] for item in passed_instances
+        }
+
+        requirements_summary = []
+        for requirement in all_requirements:
+            requirement_id = requirement["requirement_id"]
+            total_instances = requirement["total_instances"]
+            passed_count = passed_counts.get(requirement_id, 0)
+
+            requirement_status = "PASS" if passed_count == total_instances else "FAIL"
+
+            requirements_summary.append(
+                {
+                    "id": requirement_id,
+                    "framework": requirement["framework"],
+                    "version": requirement["version"],
+                    "description": requirement["description"],
+                    "status": requirement_status,
+                }
+            )
+
+        serializer = self.get_serializer(requirements_summary, many=True)
+        return Response(serializer.data, status=status.HTTP_200_OK)
+
+    @action(detail=False, methods=["get"], url_name="attributes")
+    def attributes(self, request):
+        compliance_id = request.query_params.get("filter[compliance_id]")
+        if not compliance_id:
+            raise ValidationError(
+                [
+                    {
+                        "detail": "This query parameter is required.",
+                        "status": 400,
+                        "source": {"pointer": "filter[compliance_id]"},
+                        "code": "required",
+                    }
+                ]
+            )
+
+        provider_type = None
+        try:
+            sample_requirement = (
+                self.get_queryset().filter(compliance_id=compliance_id).first()
+            )
+
+            if sample_requirement:
+                provider_type = sample_requirement.scan.provider.provider
+        except Exception:
+            pass
+
+        # If we couldn't determine from database, try each provider type
+        if not provider_type:
+            for pt in Provider.ProviderChoices.values:
+                if compliance_id in PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE.get(pt, {}):
+                    provider_type = pt
+                    break
+
+        if not provider_type:
+            raise NotFound(detail=f"Compliance framework '{compliance_id}' not found.")
+
+        compliance_template = PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE.get(
+            provider_type, {}
+        )
+        compliance_framework = compliance_template.get(compliance_id)
+
+        if not compliance_framework:
+            raise NotFound(detail=f"Compliance framework '{compliance_id}' not found.")
+
+        attribute_data = []
+        for requirement_id, requirement in compliance_framework.get(
+            "requirements", {}
+        ).items():
+            check_ids = list(requirement.get("checks", {}).keys())
+
+            metadata = requirement.get("attributes", [])
+
+            attribute_data.append(
+                {
+                    "id": requirement_id,
+                    "framework": compliance_framework.get("framework", ""),
+                    "version": compliance_framework.get("version", ""),
+                    "description": requirement.get("description", ""),
+                    "attributes": {"metadata": metadata, "check_ids": check_ids},
+                }
+            )
+
+        serializer = self.get_serializer(attribute_data, many=True)
+        return Response(serializer.data, status=status.HTTP_200_OK)
+
 
 @extend_schema(tags=["Overview"])
 @extend_schema_view(
@@ -2566,7 +2878,7 @@ class ComplianceOverviewViewSet(BaseRLSViewSet):
 class OverviewViewSet(BaseRLSViewSet):
     queryset = ComplianceOverview.objects.all()
     http_method_names = ["get"]
-    ordering = ["-id"]
+    ordering = ["-inserted_at"]
     # RBAC required permissions (implicit -> MANAGE_PROVIDERS enable unlimited visibility or check the visibility of
     # the provider through the provider group)
     required_permissions = []
@@ -2811,7 +3123,7 @@ class ScheduleViewSet(BaseRLSViewSet):
         with transaction.atomic():
             task = schedule_provider_scan(provider_instance)
 
-        prowler_task = Task.objects.get(id=task.id)
+        prowler_task = Task.objects.get_with_retry(id=task.id)
         self.response_serializer_class = TaskSerializer
         output_serializer = self.get_serializer(prowler_task)
 

api/src/backend/config/django/base.py

@@ -26,6 +26,7 @@ INSTALLED_APPS = [
     "rest_framework",
     "corsheaders",
     "drf_spectacular",
+    "drf_spectacular_jsonapi",
     "django_guid",
     "rest_framework_json_api",
     "django_celery_results",

api/src/backend/conftest.py

@@ -15,6 +15,7 @@ from tasks.jobs.backfill import backfill_resource_scan_summaries
 from api.db_utils import rls_transaction
 from api.models import (
     ComplianceOverview,
+    ComplianceRequirementOverview,
     Finding,
     Integration,
     IntegrationProviderRelationship,
@@ -29,6 +30,7 @@ from api.models import (
     Scan,
     ScanSummary,
     StateChoices,
+    StatusChoices,
     Task,
     User,
     UserRoleRelationship,
@@ -777,6 +779,98 @@ def compliance_overviews_fixture(scans_fixture, tenants_fixture):
     return compliance_overview1, compliance_overview2
 
 
+@pytest.fixture
+def compliance_requirements_overviews_fixture(scans_fixture, tenants_fixture):
+    """Fixture for ComplianceRequirementOverview objects used by the new ComplianceOverviewViewSet."""
+    tenant = tenants_fixture[0]
+    scan1, scan2, scan3 = scans_fixture
+
+    # Create ComplianceRequirementOverview objects for scan1
+    requirement_overview1 = ComplianceRequirementOverview.objects.create(
+        tenant=tenant,
+        scan=scan1,
+        compliance_id="aws_account_security_onboarding_aws",
+        framework="AWS-Account-Security-Onboarding",
+        version="1.0",
+        description="Description for AWS Account Security Onboarding",
+        region="eu-west-1",
+        requirement_id="requirement1",
+        requirement_status=StatusChoices.PASS,
+        passed_checks=2,
+        failed_checks=0,
+        total_checks=2,
+    )
+
+    requirement_overview2 = ComplianceRequirementOverview.objects.create(
+        tenant=tenant,
+        scan=scan1,
+        compliance_id="aws_account_security_onboarding_aws",
+        framework="AWS-Account-Security-Onboarding",
+        version="1.0",
+        description="Description for AWS Account Security Onboarding",
+        region="eu-west-1",
+        requirement_id="requirement2",
+        requirement_status=StatusChoices.PASS,
+        passed_checks=2,
+        failed_checks=0,
+        total_checks=2,
+    )
+
+    requirement_overview3 = ComplianceRequirementOverview.objects.create(
+        tenant=tenant,
+        scan=scan1,
+        compliance_id="aws_account_security_onboarding_aws",
+        framework="AWS-Account-Security-Onboarding",
+        version="1.0",
+        description="Description for AWS Account Security Onboarding",
+        region="eu-west-2",
+        requirement_id="requirement1",
+        requirement_status=StatusChoices.PASS,
+        passed_checks=2,
+        failed_checks=0,
+        total_checks=2,
+    )
+
+    requirement_overview4 = ComplianceRequirementOverview.objects.create(
+        tenant=tenant,
+        scan=scan1,
+        compliance_id="aws_account_security_onboarding_aws",
+        framework="AWS-Account-Security-Onboarding",
+        version="1.0",
+        description="Description for AWS Account Security Onboarding",
+        region="eu-west-2",
+        requirement_id="requirement2",
+        requirement_status=StatusChoices.FAIL,
+        passed_checks=1,
+        failed_checks=1,
+        total_checks=2,
+    )
+
+    # Create a different compliance framework for testing
+    requirement_overview5 = ComplianceRequirementOverview.objects.create(
+        tenant=tenant,
+        scan=scan1,
+        compliance_id="cis_1.4_aws",
+        framework="CIS-1.4-AWS",
+        version="1.4",
+        description="CIS AWS Foundations Benchmark v1.4.0",
+        region="eu-west-1",
+        requirement_id="cis_requirement1",
+        requirement_status=StatusChoices.FAIL,
+        passed_checks=0,
+        failed_checks=3,
+        total_checks=3,
+    )
+
+    return (
+        requirement_overview1,
+        requirement_overview2,
+        requirement_overview3,
+        requirement_overview4,
+        requirement_overview5,
+    )
+
+
 def get_api_tokens(
     api_client, user_email: str, user_password: str, tenant_id: str = None
 ) -> tuple[str, str]:

api/src/backend/tasks/jobs/scan.py

@@ -13,9 +13,9 @@ from api.compliance import (
     PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE,
     generate_scan_compliance,
 )
-from api.db_utils import rls_transaction
+from api.db_utils import create_objects_in_batches, rls_transaction
 from api.models import (
-    ComplianceOverview,
+    ComplianceRequirementOverview,
     Finding,
     Provider,
     Resource,
@@ -119,11 +119,11 @@ def perform_prowler_scan(
         ValueError: If the provider cannot be connected.
 
     """
-    check_status_by_region = {}
     exception = None
     unique_resources = set()
     scan_resource_cache: set[tuple[str, str, str, str]] = set()
     start_time = time.time()
+    exc = None
 
     with rls_transaction(tenant_id):
         provider_instance = Provider.objects.get(pk=provider_id)
@@ -139,7 +139,7 @@ def perform_prowler_scan(
                 provider_instance.connected = True
             except Exception as e:
                 provider_instance.connected = False
-                raise ValueError(
+                exc = ValueError(
                     f"Provider {provider_instance.provider} is not connected: {e}"
                 )
             finally:
@@ -148,6 +148,11 @@ def perform_prowler_scan(
                 )
                 provider_instance.save()
 
+        # If the provider is not connected, raise an exception outside the transaction.
+        # If raised within the transaction, the transaction will be rolled back and the provider will not be marked as not connected.
+        if exc:
+            raise exc
+
         prowler_scan = ProwlerScan(provider=prowler_provider, checks=checks_to_execute)
 
         resource_cache = {}
@@ -287,16 +292,6 @@ def perform_prowler_scan(
                     )
                     finding_instance.add_resources([resource_instance])
 
-                # Update compliance data if applicable
-                if finding.status.value == "MUTED":
-                    continue
-
-                region_dict = check_status_by_region.setdefault(finding.region, {})
-                current_status = region_dict.get(finding.check_id)
-                if current_status == "FAIL":
-                    continue
-                region_dict[finding.check_id] = finding.status.value
-
                 # Update scan resource summaries
                 scan_resource_cache.add(
                     (
@@ -329,63 +324,6 @@ def perform_prowler_scan(
     if exception is not None:
         raise exception
 
-    try:
-        regions = prowler_provider.get_regions()
-    except AttributeError:
-        regions = set()
-
-    compliance_template = PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE[
-        provider_instance.provider
-    ]
-    compliance_overview_by_region = {
-        region: deepcopy(compliance_template) for region in regions
-    }
-
-    for region, check_status in check_status_by_region.items():
-        compliance_data = compliance_overview_by_region.setdefault(
-            region, deepcopy(compliance_template)
-        )
-        for check_name, status in check_status.items():
-            generate_scan_compliance(
-                compliance_data,
-                provider_instance.provider,
-                check_name,
-                status,
-            )
-
-    # Prepare compliance overview objects
-    compliance_overview_objects = []
-    for region, compliance_data in compliance_overview_by_region.items():
-        for compliance_id, compliance in compliance_data.items():
-            compliance_overview_objects.append(
-                ComplianceOverview(
-                    tenant_id=tenant_id,
-                    scan=scan_instance,
-                    region=region,
-                    compliance_id=compliance_id,
-                    framework=compliance["framework"],
-                    version=compliance["version"],
-                    description=compliance["description"],
-                    requirements=compliance["requirements"],
-                    requirements_passed=compliance["requirements_status"]["passed"],
-                    requirements_failed=compliance["requirements_status"]["failed"],
-                    requirements_manual=compliance["requirements_status"]["manual"],
-                    total_requirements=compliance["total_requirements"],
-                )
-            )
-    try:
-        with rls_transaction(tenant_id):
-            ComplianceOverview.objects.bulk_create(
-                compliance_overview_objects, batch_size=500
-            )
-    except Exception as overview_exception:
-        import sentry_sdk
-
-        sentry_sdk.capture_exception(overview_exception)
-        logger.error(
-            f"Error storing compliance overview for scan {scan_id}: {overview_exception}"
-        )
-
     try:
         resource_scan_summaries = [
             ResourceScanSummary(
@@ -564,3 +502,114 @@ def aggregate_findings(tenant_id: str, scan_id: str):
             for agg in aggregation
         }
         ScanSummary.objects.bulk_create(scan_aggregations, batch_size=3000)
+
+
+def create_compliance_requirements(tenant_id: str, scan_id: str):
+    """
+    Create detailed compliance requirement overview records for a scan.
+
+    This function processes the compliance data collected during a scan and creates
+    individual records for each compliance requirement in each region. These detailed
+    records provide a granular view of compliance status.
+
+    Args:
+        tenant_id (str): The ID of the tenant for which to create records.
+        scan_id (str): The ID of the scan for which to create records.
+
+    Returns:
+        dict: A dictionary containing the number of requirements created and the regions processed.
+
+    Raises:
+        ValidationError: If tenant_id is not a valid UUID.
+    """
+    try:
+        with rls_transaction(tenant_id):
+            scan_instance = Scan.objects.get(pk=scan_id)
+            provider_instance = scan_instance.provider
+            prowler_provider = initialize_prowler_provider(provider_instance)
+
+        # Get check status data by region from findings
+        check_status_by_region = {}
+        with rls_transaction(tenant_id):
+            findings = Finding.objects.filter(scan_id=scan_id, muted=False)
+            for finding in findings:
+                # Get region from resources
+                for resource in finding.resources.all():
+                    region = resource.region
+                    region_dict = check_status_by_region.setdefault(region, {})
+                    current_status = region_dict.get(finding.check_id)
+                    if current_status == "FAIL":
+                        continue
+                    region_dict[finding.check_id] = finding.status
+
+        try:
+            # Try to get regions from provider
+            regions = prowler_provider.get_regions()
+        except (AttributeError, Exception):
+            # If not available, use regions from findings
+            regions = set(check_status_by_region.keys())
+
+        # Get compliance template for the provider
+        compliance_template = PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE[
+            provider_instance.provider
+        ]
+
+        # Create compliance data by region
+        compliance_overview_by_region = {
+            region: deepcopy(compliance_template) for region in regions
+        }
+
+        # Apply check statuses to compliance data
+        for region, check_status in check_status_by_region.items():
+            compliance_data = compliance_overview_by_region.setdefault(
+                region, deepcopy(compliance_template)
+            )
+            for check_name, status in check_status.items():
+                generate_scan_compliance(
+                    compliance_data,
+                    provider_instance.provider,
+                    check_name,
+                    status,
+                )
+
+        # Prepare compliance requirement objects
+        compliance_requirement_objects = []
+        for region, compliance_data in compliance_overview_by_region.items():
+            for compliance_id, compliance in compliance_data.items():
+                # Create an overview record for each requirement within each compliance framework
+                for requirement_id, requirement in compliance["requirements"].items():
+                    compliance_requirement_objects.append(
+                        ComplianceRequirementOverview(
+                            tenant_id=tenant_id,
+                            scan=scan_instance,
+                            region=region,
+                            compliance_id=compliance_id,
+                            framework=compliance["framework"],
+                            version=compliance["version"],
+                            requirement_id=requirement_id,
+                            description=requirement["description"],
+                            passed_checks=requirement["checks_status"]["pass"],
+                            failed_checks=requirement["checks_status"]["fail"],
+                            total_checks=requirement["checks_status"]["total"],
+                            requirement_status=requirement["status"],
+                        )
+                    )
+
+        # Bulk create requirement records
+        create_objects_in_batches(
+            tenant_id, ComplianceRequirementOverview, compliance_requirement_objects
+        )
+
+        return {
+            "requirements_created": len(compliance_requirement_objects),
+            "regions_processed": list(regions),
+            "compliance_frameworks": (
+                list(compliance_overview_by_region.get(list(regions)[0], {}).keys())
+                if regions
+                else []
+            ),
+        }
+
+    except Exception as e:
+        logger.error(f"Error creating compliance requirements for scan {scan_id}: {e}")
+        raise e

api/src/backend/tasks/tasks.py

@@ -17,7 +17,11 @@ from tasks.jobs.export import (
     _generate_output_directory,
     _upload_to_s3,
 )
-from tasks.jobs.scan import aggregate_findings, perform_prowler_scan
+from tasks.jobs.scan import (
+    aggregate_findings,
+    create_compliance_requirements,
+    perform_prowler_scan,
+)
 from tasks.utils import batched, get_next_execution_datetime
 
 from api.compliance import get_compliance_frameworks
@@ -101,6 +105,7 @@ def perform_scan_task(
 
     chain(
         perform_scan_summary_task.si(tenant_id, scan_id),
+        create_compliance_requirements_task.si(tenant_id=tenant_id, scan_id=scan_id),
         generate_outputs.si(
             scan_id=scan_id, provider_id=provider_id, tenant_id=tenant_id
         ),
@@ -211,6 +216,9 @@ def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
 
     chain(
         perform_scan_summary_task.si(tenant_id, scan_instance.id),
+        create_compliance_requirements_task.si(
+            tenant_id=tenant_id, scan_id=str(scan_instance.id)
+        ),
         generate_outputs.si(
             scan_id=str(scan_instance.id), provider_id=provider_id, tenant_id=tenant_id
         ),
@@ -371,3 +379,19 @@ def backfill_scan_resource_summaries_task(tenant_id: str, scan_id: str):
         scan_id (str): The scan identifier.
     """
     return backfill_resource_scan_summaries(tenant_id=tenant_id, scan_id=scan_id)
+
+
+@shared_task(base=RLSTask, name="scan-compliance-overviews")
+def create_compliance_requirements_task(tenant_id: str, scan_id: str):
+    """
+    Creates detailed compliance requirement records for a scan.
+
+    This task processes the compliance data collected during a scan and creates
+    individual records for each compliance requirement in each region. These detailed
+    records provide a granular view of compliance status.
+
+    Args:
+        tenant_id (str): The tenant ID for which to create records.
+        scan_id (str): The ID of the scan for which to create records.
+    """
+    return create_compliance_requirements(tenant_id=tenant_id, scan_id=scan_id)

api/src/backend/tasks/tests/test_scan.py

@@ -1,16 +1,19 @@
 import json
 import uuid
+from datetime import datetime
 from unittest.mock import MagicMock, patch
 
 import pytest
 from tasks.jobs.scan import (
     _create_finding_delta,
     _store_resources,
+    create_compliance_requirements,
     perform_prowler_scan,
 )
 from tasks.utils import CustomEncoder
 
 from api.models import (
+    ComplianceRequirementOverview,
     Finding,
     Provider,
     Resource,
@@ -206,6 +209,10 @@ class TestPerformScan:
         scan.refresh_from_db()
         assert scan.state == StateChoices.FAILED
 
+        provider.refresh_from_db()
+        assert provider.connected is False
+        assert isinstance(provider.connection_last_checked_at, datetime)
+
     @pytest.mark.parametrize(
         "last_status, new_status, expected_delta",
         [
@@ -230,7 +237,7 @@ class TestPerformScan:
     ):
         tenant_id = uuid.uuid4()
         provider_instance = MagicMock()
-        provider_instance.id = "provider456"
+        provider_instance.id = "provider123"
 
         finding = MagicMock()
         finding.resource_uid = "resource_uid_123"
@@ -245,15 +252,16 @@ class TestPerformScan:
         resource_instance.region = finding.region
 
         mock_get_or_create_resource.return_value = (resource_instance, True)
+
         tag_instance = MagicMock()
         mock_get_or_create_tag.return_value = (tag_instance, True)
 
         resource, resource_uid_tuple = _store_resources(
-            finding, tenant_id, provider_instance
+            finding, str(tenant_id), provider_instance
         )
 
         mock_get_or_create_resource.assert_called_once_with(
-            tenant_id=tenant_id,
+            tenant_id=str(tenant_id),
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
@@ -300,11 +308,11 @@ class TestPerformScan:
         mock_get_or_create_tag.return_value = (tag_instance, True)
 
         resource, resource_uid_tuple = _store_resources(
-            finding, tenant_id, provider_instance
+            finding, str(tenant_id), provider_instance
         )
 
         mock_get_or_create_resource.assert_called_once_with(
-            tenant_id=tenant_id,
+            tenant_id=str(tenant_id),
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
@@ -358,14 +366,14 @@ class TestPerformScan:
         ]
 
         resource, resource_uid_tuple = _store_resources(
-            finding, tenant_id, provider_instance
+            finding, str(tenant_id), provider_instance
         )
 
         mock_get_or_create_tag.assert_any_call(
-            tenant_id=tenant_id, key="tag1", value="value1"
+            tenant_id=str(tenant_id), key="tag1", value="value1"
         )
         mock_get_or_create_tag.assert_any_call(
-            tenant_id=tenant_id, key="tag2", value="value2"
+            tenant_id=str(tenant_id), key="tag2", value="value2"
         )
         resource_instance.upsert_or_delete_tags.assert_called_once()
         tags_passed = resource_instance.upsert_or_delete_tags.call_args[1]["tags"]
@@ -377,3 +385,808 @@ class TestPerformScan:
 
 
 # TODO Add tests for aggregations
+
+
+@pytest.mark.django_db
+class TestCreateComplianceRequirements:
+    def test_create_compliance_requirements_success(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+        findings_fixture,
+        resources_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch("tasks.jobs.scan.generate_scan_compliance"),
+            patch("tasks.jobs.scan.create_objects_in_batches") as mock_create_objects,
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.return_value = [
+                "us-east-1",
+                "us-west-2",
+            ]
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {
+                "cis_1.4_aws": {
+                    "framework": "CIS AWS Foundations Benchmark",
+                    "version": "1.4.0",
+                    "requirements": {
+                        "1.1": {
+                            "description": "Ensure root access key does not exist",
+                            "checks_status": {
+                                "pass": 0,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "PASS",
+                        },
+                        "1.2": {
+                            "description": "Ensure MFA is enabled for root account",
+                            "checks_status": {
+                                "pass": 0,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "FAIL",
+                        },
+                    },
+                },
+                "aws_account_security_onboarding_aws": {
+                    "framework": "AWS Account Security Onboarding",
+                    "version": "1.0",
+                    "requirements": {
+                        "requirement1": {
+                            "description": "Basic security requirement",
+                            "checks_status": {
+                                "pass": 1,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "PASS",
+                        },
+                    },
+                },
+            }
+
+            mock_findings_filter.return_value = []
+
+            result = create_compliance_requirements(tenant_id, scan_id)
+
+            assert "requirements_created" in result
+            assert "regions_processed" in result
+            assert "compliance_frameworks" in result
+            assert result["regions_processed"] == ["us-east-1", "us-west-2"]
+            assert result["requirements_created"] == 6
+            assert len(result["compliance_frameworks"]) == 2
+
+            mock_create_objects.assert_called_once()
+            call_args = mock_create_objects.call_args[0]
+            assert call_args[0] == tenant_id
+            assert call_args[1] == ComplianceRequirementOverview
+            assert len(call_args[2]) == 6
+
+            compliance_objects = call_args[2]
+            for obj in compliance_objects:
+                assert isinstance(obj, ComplianceRequirementOverview)
+                assert obj.tenant.id == tenant.id
+                assert obj.scan == scan
+                assert obj.region in ["us-east-1", "us-west-2"]
+                assert obj.compliance_id in [
+                    "cis_1.4_aws",
+                    "aws_account_security_onboarding_aws",
+                ]
+
+    def test_create_compliance_requirements_with_findings(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches"),
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_finding1 = MagicMock()
+            mock_finding1.check_id = "check1"
+            mock_finding1.status = "PASS"
+            mock_resource1 = MagicMock()
+            mock_resource1.region = "us-east-1"
+            mock_finding1.resources.all.return_value = [mock_resource1]
+
+            mock_finding2 = MagicMock()
+            mock_finding2.check_id = "check2"
+            mock_finding2.status = "FAIL"
+            mock_resource2 = MagicMock()
+            mock_resource2.region = "us-west-2"
+            mock_finding2.resources.all.return_value = [mock_resource2]
+
+            mock_findings_filter.return_value = [mock_finding1, mock_finding2]
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.return_value = [
+                "us-east-1",
+                "us-west-2",
+            ]
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {"check_1": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 3,
+                            },
+                            "status": "FAIL",
+                        },
+                        "req_2": {
+                            "description": "Test Requirement 2",
+                            "checks": {"check_2": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "PASS",
+                        },
+                    },
+                }
+            }
+
+            result = create_compliance_requirements(tenant_id, scan_id)
+
+            mock_findings_filter.assert_called_once_with(scan_id=scan_id, muted=False)
+            assert mock_generate_compliance.call_count == 2
+            assert result["requirements_created"] == 4
+            assert set(result["regions_processed"]) == {"us-east-1", "us-west-2"}
+
+    def test_create_compliance_requirements_no_provider_regions(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch("tasks.jobs.scan.generate_scan_compliance"),
+            patch("tasks.jobs.scan.create_objects_in_batches"),
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.KUBERNETES
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_finding = MagicMock()
+            mock_finding.check_id = "check1"
+            mock_finding.status = "PASS"
+            mock_resource = MagicMock()
+            mock_resource.region = "default"
+            mock_finding.resources.all.return_value = [mock_resource]
+            mock_findings_filter.return_value = [mock_finding]
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.side_effect = AttributeError(
+                "No get_regions method"
+            )
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {
+                "kubernetes_cis": {
+                    "framework": "CIS Kubernetes Benchmark",
+                    "version": "1.6.0",
+                    "requirements": {
+                        "1.1": {
+                            "description": "Test requirement",
+                            "checks_status": {
+                                "pass": 0,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "PASS",
+                        },
+                    },
+                },
+            }
+
+            result = create_compliance_requirements(tenant_id, scan_id)
+
+            assert result["regions_processed"] == ["default"]
+
+    def test_create_compliance_requirements_empty_findings(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches"),
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_findings_filter.return_value = []
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {
+                "cis_1.4_aws": {
+                    "framework": "CIS AWS Foundations Benchmark",
+                    "version": "1.4.0",
+                    "requirements": {
+                        "1.1": {
+                            "description": "Test requirement",
+                            "checks_status": {
+                                "pass": 0,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "PASS",
+                        },
+                    },
+                },
+            }
+
+            mock_findings_filter.return_value = []
+
+            result = create_compliance_requirements(tenant_id, scan_id)
+
+            assert result["regions_processed"] == ["us-east-1"]
+            assert result["requirements_created"] == 1
+            mock_generate_compliance.assert_not_called()
+
+    def test_create_compliance_requirements_error_handling(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_initialize_prowler_provider.side_effect = Exception(
+                "Provider initialization failed"
+            )
+
+            with pytest.raises(Exception, match="Provider initialization failed"):
+                create_compliance_requirements(tenant_id, scan_id)
+
+    def test_create_compliance_requirements_muted_findings_excluded(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch("tasks.jobs.scan.generate_scan_compliance"),
+            patch("tasks.jobs.scan.create_objects_in_batches"),
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_findings_filter.return_value = []
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {}
+
+            mock_findings_filter.return_value = []
+
+            create_compliance_requirements(tenant_id, scan_id)
+
+            mock_findings_filter.assert_called_once_with(scan_id=scan_id, muted=False)
+
+    def test_create_compliance_requirements_check_status_priority(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches"),
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            provider = providers_fixture[0]
+
+            provider.provider = Provider.ProviderChoices.AWS
+            provider.save()
+            scan.provider = provider
+            scan.save()
+
+            tenant_id = str(tenant.id)
+            scan_id = str(scan.id)
+
+            mock_finding1 = MagicMock()
+            mock_finding1.check_id = "check1"
+            mock_finding1.status = "PASS"
+            mock_resource1 = MagicMock()
+            mock_resource1.region = "us-east-1"
+            mock_finding1.resources.all.return_value = [mock_resource1]
+
+            mock_finding2 = MagicMock()
+            mock_finding2.check_id = "check1"
+            mock_finding2.status = "FAIL"
+            mock_resource2 = MagicMock()
+            mock_resource2.region = "us-east-1"
+            mock_finding2.resources.all.return_value = [mock_resource2]
+
+            mock_findings_filter.return_value = [mock_finding1, mock_finding2]
+
+            mock_prowler_provider_instance = MagicMock()
+            mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
+            mock_initialize_prowler_provider.return_value = (
+                mock_prowler_provider_instance
+            )
+
+            mock_compliance_template.__getitem__.return_value = {
+                "cis_1.4_aws": {
+                    "framework": "CIS AWS Foundations Benchmark",
+                    "version": "1.4.0",
+                    "requirements": {
+                        "1.1": {
+                            "description": "Test requirement",
+                            "checks_status": {
+                                "pass": 0,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 1,
+                            },
+                            "status": "PASS",
+                        },
+                    },
+                },
+            }
+
+            create_compliance_requirements(tenant_id, scan_id)
+
+            assert mock_generate_compliance.call_count == 1
+
+    def test_compliance_overview_aggregation_requirement_fail_priority(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches") as mock_create_objects,
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            providers_fixture[0]
+
+            mock_findings_filter.return_value = []
+
+            mock_prowler_provider = MagicMock()
+            mock_prowler_provider.get_regions.return_value = [
+                "us-east-1",
+                "us-west-2",
+                "eu-west-1",
+            ]
+            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+
+            mock_compliance_template.__getitem__.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {"check_1": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 3,
+                            },
+                            "status": "FAIL",
+                        }
+                    },
+                }
+            }
+
+            mock_generate_compliance.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {
+                                "check_1": {
+                                    "us-east-1": {"status": "PASS"},
+                                    "us-west-2": {"status": "FAIL"},
+                                    "eu-west-1": {"status": "PASS"},
+                                }
+                            },
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 3,
+                            },
+                            "status": "FAIL",
+                        }
+                    },
+                }
+            }
+
+            created_objects = []
+            mock_create_objects.side_effect = (
+                lambda tenant_id, model, objs, batch_size=500: created_objects.extend(
+                    objs
+                )
+            )
+
+            create_compliance_requirements(str(tenant.id), str(scan.id))
+
+            assert len(created_objects) == 3
+            assert all(obj.requirement_status == "FAIL" for obj in created_objects)
+
+    def test_compliance_overview_aggregation_requirement_pass_all_regions(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches") as mock_create_objects,
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            providers_fixture[0]
+
+            mock_findings_filter.return_value = []
+
+            mock_prowler_provider = MagicMock()
+            mock_prowler_provider.get_regions.return_value = ["us-east-1", "us-west-2"]
+            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+
+            mock_compliance_template.__getitem__.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {"check_1": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "PASS",
+                        }
+                    },
+                }
+            }
+
+            mock_generate_compliance.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {
+                                "check_1": {
+                                    "us-east-1": {"status": "PASS"},
+                                    "us-west-2": {"status": "PASS"},
+                                }
+                            },
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "PASS",
+                        }
+                    },
+                }
+            }
+
+            created_objects = []
+            mock_create_objects.side_effect = (
+                lambda tenant_id, model, objs, batch_size=500: created_objects.extend(
+                    objs
+                )
+            )
+
+            create_compliance_requirements(str(tenant.id), str(scan.id))
+
+            assert len(created_objects) == 2
+            assert all(obj.requirement_status == "PASS" for obj in created_objects)
+
+    def test_compliance_overview_aggregation_multiple_requirements_mixed_status(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        providers_fixture,
+    ):
+        with (
+            patch("api.db_utils.rls_transaction"),
+            patch(
+                "tasks.jobs.scan.initialize_prowler_provider"
+            ) as mock_initialize_prowler_provider,
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan.generate_scan_compliance"
+            ) as mock_generate_compliance,
+            patch("tasks.jobs.scan.create_objects_in_batches") as mock_create_objects,
+            patch("api.models.Finding.objects.filter") as mock_findings_filter,
+        ):
+            tenant = tenants_fixture[0]
+            scan = scans_fixture[0]
+            providers_fixture[0]
+
+            mock_findings_filter.return_value = []
+
+            mock_prowler_provider = MagicMock()
+            mock_prowler_provider.get_regions.return_value = ["us-east-1", "us-west-2"]
+            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+
+            mock_compliance_template.__getitem__.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {"check_1": None},
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "PASS",
+                        },
+                        "req_2": {
+                            "description": "Test Requirement 2",
+                            "checks": {"check_2": None},
+                            "checks_status": {
+                                "pass": 1,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "FAIL",
+                        },
+                    },
+                }
+            }
+
+            mock_generate_compliance.return_value = {
+                "test_compliance": {
+                    "framework": "Test Framework",
+                    "version": "1.0",
+                    "requirements": {
+                        "req_1": {
+                            "description": "Test Requirement 1",
+                            "checks": {
+                                "check_1": {
+                                    "us-east-1": {"status": "PASS"},
+                                    "us-west-2": {"status": "PASS"},
+                                }
+                            },
+                            "checks_status": {
+                                "pass": 2,
+                                "fail": 0,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "PASS",
+                        },
+                        "req_2": {
+                            "description": "Test Requirement 2",
+                            "checks": {
+                                "check_2": {
+                                    "us-east-1": {"status": "PASS"},
+                                    "us-west-2": {"status": "FAIL"},
+                                }
+                            },
+                            "checks_status": {
+                                "pass": 1,
+                                "fail": 1,
+                                "manual": 0,
+                                "total": 2,
+                            },
+                            "status": "FAIL",
+                        },
+                    },
+                }
+            }
+
+            created_objects = []
+            mock_create_objects.side_effect = (
+                lambda tenant_id, model, objs, batch_size=500: created_objects.extend(
+                    objs
+                )
+            )
+
+            create_compliance_requirements(str(tenant.id), str(scan.id))
+
+            assert len(created_objects) == 4
+            req_1_objects = [
+                obj for obj in created_objects if obj.requirement_id == "req_1"
+            ]
+            req_2_objects = [
+                obj for obj in created_objects if obj.requirement_id == "req_2"
+            ]
+            assert len(req_1_objects) == 2
+            assert len(req_2_objects) == 2
+            assert all(obj.requirement_status == "PASS" for obj in req_1_objects)
+            assert all(obj.requirement_status == "FAIL" for obj in req_2_objects)

dashboard/compliance/nis2_aws.py

@@ -0,0 +1,43 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_3_levels
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+    data["REQUIREMENTS_DESCRIPTION"] = (
+        data["REQUIREMENTS_ID"] + " - " + data["REQUIREMENTS_DESCRIPTION"]
+    )
+
+    data["REQUIREMENTS_DESCRIPTION"] = data["REQUIREMENTS_DESCRIPTION"].apply(
+        lambda x: x[:150] + "..." if len(str(x)) > 150 else x
+    )
+
+    data["REQUIREMENTS_ATTRIBUTES_SECTION"] = data[
+        "REQUIREMENTS_ATTRIBUTES_SECTION"
+    ].apply(lambda x: x[:80] + "..." if len(str(x)) > 80 else x)
+
+    data["REQUIREMENTS_ATTRIBUTES_SUBSECTION"] = data[
+        "REQUIREMENTS_ATTRIBUTES_SUBSECTION"
+    ].apply(lambda x: x[:150] + "..." if len(str(x)) > 150 else x)
+
+    aux = data[
+        [
+            "REQUIREMENTS_DESCRIPTION",
+            "REQUIREMENTS_ATTRIBUTES_SECTION",
+            "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+            "CHECKID",
+            "STATUS",
+            "REGION",
+            "ACCOUNTID",
+            "RESOURCEID",
+        ]
+    ]
+
+    return get_section_containers_3_levels(
+        aux,
+        "REQUIREMENTS_ATTRIBUTES_SECTION",
+        "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+        "REQUIREMENTS_DESCRIPTION",
+    )

dashboard/compliance/nis2_azure.py

@@ -0,0 +1,43 @@
+import warnings
+
+from dashboard.common_methods import get_section_containers_3_levels
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+    data["REQUIREMENTS_DESCRIPTION"] = (
+        data["REQUIREMENTS_ID"] + " - " + data["REQUIREMENTS_DESCRIPTION"]
+    )
+
+    data["REQUIREMENTS_DESCRIPTION"] = data["REQUIREMENTS_DESCRIPTION"].apply(
+        lambda x: x[:150] + "..." if len(str(x)) > 150 else x
+    )
+
+    data["REQUIREMENTS_ATTRIBUTES_SECTION"] = data[
+        "REQUIREMENTS_ATTRIBUTES_SECTION"
+    ].apply(lambda x: x[:80] + "..." if len(str(x)) > 80 else x)
+
+    data["REQUIREMENTS_ATTRIBUTES_SUBSECTION"] = data[
+        "REQUIREMENTS_ATTRIBUTES_SUBSECTION"
+    ].apply(lambda x: x[:150] + "..." if len(str(x)) > 150 else x)
+
+    aux = data[
+        [
+            "REQUIREMENTS_DESCRIPTION",
+            "REQUIREMENTS_ATTRIBUTES_SECTION",
+            "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+            "CHECKID",
+            "STATUS",
+            "REGION",
+            "ACCOUNTID",
+            "RESOURCEID",
+        ]
+    ]
+
+    return get_section_containers_3_levels(
+        aux,
+        "REQUIREMENTS_ATTRIBUTES_SECTION",
+        "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
+        "REQUIREMENTS_DESCRIPTION",
+    )

dashboard/lib/layouts.py

@@ -90,12 +90,28 @@ def create_layout_overview(
                     ),
                     html.Div(
                         [
-                            (
-                                html.Label(
-                                    "Table Rows:",
-                                    className="text-prowler-stone-900 font-bold text-sm",
-                                    style={"margin-right": "10px"},
-                                )
+                            html.Label(
+                                "Search:",
+                                className="text-prowler-stone-900 font-bold text-sm",
+                                style={"margin-right": "10px"},
+                            ),
+                            dcc.Input(
+                                id="search-input",
+                                type="text",
+                                placeholder="Search by check title, service, region...",
+                                debounce=True,
+                                style={
+                                    "padding": "4px 8px",
+                                    "border": "1px solid #ccc",
+                                    "borderRadius": "4px",
+                                    "marginRight": "20px",
+                                    "width": "250px",
+                                },
+                            ),
+                            html.Label(
+                                "Table Rows:",
+                                className="text-prowler-stone-900 font-bold text-sm",
+                                style={"margin-right": "10px"},
                             ),
                             table_row_dropdown,
                             download_button_csv,

dashboard/pages/overview.py

@@ -518,6 +518,7 @@ else:
     Input("service-filter", "value"),
     Input("table-rows", "value"),
     Input("status-filter", "value"),
+    Input("search-input", "value"),
     Input("aws_card", "n_clicks"),
     Input("azure_card", "n_clicks"),
     Input("gcp_card", "n_clicks"),
@@ -540,6 +541,7 @@ def filter_data(
     service_values,
     table_row_values,
     status_values,
+    search_value,
     aws_clicks,
     azure_clicks,
     gcp_clicks,
@@ -1144,6 +1146,15 @@ def filter_data(
         }
 
         index_count = 0
+        if search_value:
+            search_value = search_value.lower()
+            filtered_data = filtered_data[
+                filtered_data["CHECK_TITLE"].str.lower().str.contains(search_value)
+                | filtered_data["SERVICE_NAME"].str.lower().str.contains(search_value)
+                | filtered_data["REGION"].str.lower().str.contains(search_value)
+                | filtered_data["STATUS"].str.lower().str.contains(search_value)
+            ]
+
         full_filtered_data = filtered_data.copy()
         filtered_data = filtered_data.head(table_row_values)
         # Sort the filtered_data

docs/getting-started/requirements.md

@@ -70,7 +70,7 @@ The other three cases does not need additional configuration, `--az-cli-auth` an
 Prowler for Azure needs two types of permission scopes to be set:
 
 - **Microsoft Entra ID permissions**: used to retrieve metadata from the identity assumed by Prowler and specific Entra checks (not mandatory to have access to execute the tool). The permissions required by the tool are the following:
-    - `Directory.Read.All`
+    - `Domain.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All` (used only for the Entra checks related with multifactor authentication)
 - **Subscription scope permissions**: required to launch the checks against your resources, mandatory to launch the tool. It is required to add the following RBAC builtin roles per subscription to the entity that is going to be assumed by the tool:
@@ -81,6 +81,9 @@ Prowler for Azure needs two types of permission scopes to be set:
 
 To assign the permissions, follow the instructions in the [Microsoft Entra ID permissions](../tutorials/azure/create-prowler-service-principal.md#assigning-the-proper-permissions) section and the [Azure subscriptions permissions](../tutorials/azure/subscriptions.md#assign-the-appropriate-permissions-to-the-identity-that-is-going-to-be-assumed-by-prowler) section, respectively.
 
+???+ warning
+    Some permissions in `ProwlerRole` are considered **write** permissions, so if you have a `ReadOnly` lock attached to some resources you may get an error and will not get a finding for that check.
+
 #### Checks that require ProwlerRole
 
 The following checks require the `ProwlerRole` permissions to be executed, if you want to run them, make sure you have assigned the role to the identity that is going to be assumed by Prowler:
@@ -153,77 +156,31 @@ With this credentials you will only be able to run the checks that work through
 
 Authentication flag: `--env-auth`
 
-This authentication method follows the same approach as the service principal method but introduces two additional environment variables for user credentials:  `M365_USER` and `M365_ENCRYPTED_PASSWORD`.
+This authentication method follows the same approach as the service principal method but introduces two additional environment variables for user credentials:  `M365_USER` and `M365_PASSWORD`.
 
 ```console
 export AZURE_CLIENT_ID="XXXXXXXXX"
 export AZURE_CLIENT_SECRET="XXXXXXXXX"
 export AZURE_TENANT_ID="XXXXXXXXX"
 export M365_USER="your_email@example.com"
-export M365_ENCRYPTED_PASSWORD="6500780061006d0070006c006500700061007300730077006f0072006400" # replace this to yours
+export M365_PASSWORD="examplepassword"
 ```
 
 These two new environment variables are **required** to execute the PowerShell modules needed to retrieve information from M365 services. Prowler uses Service Principal authentication to access Microsoft Graph and user credentials to authenticate to Microsoft PowerShell modules.
 
-- `M365_USER` should be your Microsoft account email using the default domain. This means it must look like `example@YourCompany.onmicrosoft.com`.
+- `M365_USER` should be your Microsoft account email using the **assigned domain in the tenant**. This means it must look like `example@YourCompany.onmicrosoft.com` or `example@YourCompany.com`, but it must be the exact domain assigned to that user in the tenant.
 
-    To ensure that you are using the default domain you can see how to verify it [here](../tutorials/microsoft365/getting-started-m365.md#step-1-obtain-your-domain).
+    ???+ warning
+        Using a tenant domain other than the one assigned — even if it belongs to the same tenant — will cause Prowler to fail, as Microsoft authentication will not succeed.
 
-    If you don't have a user created with that domain, Prowler will not work as it will not be able to ensure both app an user belong to the same tenant. To proceed, you can either create a new user with that domain or modify the domain of an existing user.
+    Ensure you are using the right domain for the user you are trying to authenticate with.
 
     ![User Domains](../tutorials/microsoft365/img/user-domains.png)
 
-- `M365_ENCRYPTED_PASSWORD` must be an encrypted SecureString. To convert your password into a valid encrypted string, you need to use PowerShell.
-
-    ???+ warning
-        Passwords encrypted using ConvertTo-SecureString can only be decrypted on the same OS/user context. If you generate an encrypted password on macOS or Linux (both UNIX), it should fail on Windows and vice versa. As Prowler Cloud runs on UNIX if you generate your password using Windows it won't work so you'll need to generate a new password using any UNIX distro (example above)
-
-    If you are working from Windows and you will use your encrypted password in a different system (like for example executing Prowler in macOS or adding your password to Prowler Cloud), you will need to generate a "UNIX compatible" version of your encrypted password. This can be done using WSL which is so easy to install on Windows.
-
-    === "UNIX"
-
-        Open a PowerShell cmd with a [supported version](requirements.md#supported-powershell-versions) and then run the following command:
-
-        ```console
-        $securePassword = ConvertTo-SecureString "examplepassword" -AsPlainText -Force
-        $encryptedPassword = $securePassword | ConvertFrom-SecureString
-        Write-Output $encryptedPassword
-        6500780061006d0070006c006500700061007300730077006f0072006400
-        ```
-
-        If everything is done correctly, you will see the encrypted string that you need to set as the `M365_ENCRYPTED_PASSWORD` environment variable.
-
-    === "Windows"
-
-
-        How to install WSL and PowerShell on it to generate that password (you can use a different distro but this one will work for sure):
-
-        ```console
-        wsl --install -d Ubuntu-22.04
-        ```
-
-        Then, open the Ubuntu terminal and run the following commands:
-
-        ```console
-        sudo apt update && sudo apt install -y wget apt-transport-https software-properties-common
-        wget -q "https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb"
-        sudo dpkg -i packages-microsoft-prod.deb
-        sudo apt update
-        sudo apt install -y powershell
-        pwsh
-        ```
-
-        With this done you will see now that a prompt running PowerShell with the latest version is open so here you will be able to generate your encrypted password:
-
-        ```console
-        $securePassword = ConvertTo-SecureString "examplepassword" -AsPlainText -Force
-        $encryptedPassword = $securePassword | ConvertFrom-SecureString
-        Write-Output $encryptedPassword
-        6500780061006d0070006c006500700061007300730077006f0072006400
-        ```
-
-        If everything is done correctly, you will see the encrypted string that you need to set as the `M365_ENCRYPTED_PASSWORD` environment variable.
+- `M365_PASSWORD` must be the user password.
 
+    ???+ note
+        Before we asked for a encrypted password, but now we ask for the user password directly. Prowler will now handle the password encryption for you.
 
 
 ### Interactive Browser authentication
@@ -242,10 +199,9 @@ Since this is a delegated permission authentication method, necessary permission
 Prowler for M365 requires two types of permission scopes to be set (if you want to run the full provider including PowerShell checks). Both must be configured using Microsoft Entra ID:
 
 - **Service Principal Application Permissions**: These are set at the **application** level and are used to retrieve data from the identity being assessed:
-    - `Directory.Read.All`: Required for all services.
+    - `Domain.Read.All`: Required for all services.
     - `Policy.Read.All`: Required for all services.
     - `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in.
-    - `Sites.Read.All`: Required for SharePoint service.
     - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
     - `AuditLog.Read.All`: Required for Entra service.
 

docs/tutorials/azure/create-prowler-service-principal.md

@@ -40,7 +40,7 @@ az ad sp create-for-rbac --name "ProwlerApp"
 
 To allow Prowler to retrieve metadata from the identity assumed and run specific Entra checks, it is needed to assign the following permissions:
 
-- `Directory.Read.All`
+- `Domain.Read.All`
 - `Policy.Read.All`
 - `UserAuthenticationMethod.Read.All` (used only for the Entra checks related with multifactor authentication)
 
@@ -58,7 +58,7 @@ To assign the permissions you can make it from the Azure Portal or using the Azu
 5. Then click on "+ Add a permission" and select "Microsoft Graph"
 6. Once in the "Microsoft Graph" view, select "Application permissions"
 7. Finally, search for "Directory", "Policy" and "UserAuthenticationMethod" select the following permissions:
-    - `Directory.Read.All`
+    - `Domain.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All`
 8. Click on "Add permissions" to apply the new permissions.

docs/tutorials/azure/getting-started-azure.md

@@ -90,7 +90,7 @@ A Service Principal is required to grant Prowler the necessary privileges.
 
 Assign the following Microsoft Graph permissions:
 
-    - Directory.Read.All
+    - Domain.Read.All
 
     - Policy.Read.All
 
@@ -107,11 +107,11 @@ Assign the following Microsoft Graph permissions:
 
 3. Search and select:
 
-    - `Directory.Read.All`
+    - `Domain.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All`
 
-    ![Permission Screenshots](./img/directory-permission.png)
+    ![Permission Screenshots](./img/domain-permission.png)
 
 4. Click `Add permissions`, then grant admin consent
 

docs/tutorials/configuration_file.md

@@ -109,6 +109,15 @@ The following list includes all the Microsoft 365 checks with configurable varia
 | `exchange_organization_mailtips_enabled`                      | `recommended_mailtips_large_audience_threshold`  | Integer         |
 
 
+## GitHub
+
+### Configurable Checks
+The following list includes all the GitHub checks with configurable variables that can be changed in the configuration yaml file:
+
+| Check Name                                 | Value                                       | Type    |
+|--------------------------------------------|---------------------------------------------|---------|
+| `repository_inactive_not_archived`         | `inactive_not_archived_days_threshold`        | Integer |
+
 ## Config YAML File Structure
 
 ???+ note
@@ -525,5 +534,10 @@ m365:
   # m365.exchange_organization_mailtips_enabled
   recommended_mailtips_large_audience_threshold: 25 # maximum number of recipients
 
+# GitHub Configuration
+github:
+  # github.repository_inactive_not_archived
+  inactive_not_archived_days_threshold: 180
+
 
 ```

docs/tutorials/microsoft365/getting-started-m365.md

@@ -4,9 +4,9 @@ Set up your M365 account to enable security scanning using Prowler Cloud/App.
 
 ## Requirements
 
-To configure your M365 account, you’ll need:
+To configure your M365 account, you'll need:
 
-1. Obtain your `Default Domain` from the Entra ID portal.
+1. Obtain a domain from the Entra ID portal.
 
 2. Access Prowler Cloud/App and add a new cloud provider `Microsoft 365`.
 
@@ -18,8 +18,6 @@ To configure your M365 account, you’ll need:
 
     3.3 Assign the required roles to your user.
 
-    3.4 Retrieve your encrypted password.
-
 4. Add the credentials to Prowler Cloud/App.
 
 ## Step 1: Obtain your Domain
@@ -32,9 +30,7 @@ Go to the Entra ID portal, then you can search for `Domain` or go to Identity >
 
 ![Custom Domain Names](./img/custom-domain-names.png)
 
-Once you are there just look for the `Default Domain` this should be something similar to `YourCompany.onmicrosoft.com`. To ensure that you are picking the correct domain just click on it and verify that the type is `Initial` and you can't delete it.
-
-![Search Default Domain](./img/search-default-domain.png)
+Once you are there just select the domain you want to use.
 
 ---
 
@@ -78,11 +74,11 @@ A Service Principal is required to grant Prowler the necessary privileges.
 
     ![New Registration](./img/new-registration.png)
 
-4. Go to `Certificates & secrets` > `+ New client secret`
+4. Go to `Certificates & secrets` > `Client secrets` > `+ New client secret`
 
     ![Certificate & Secrets nav](./img/certificates-and-secrets.png)
 
-5. Fill in the required fields and click `Add`, then copy the generated value (that value will be `AZURE_CLIENT_SECRET`)
+5. Fill in the required fields and click `Add`, then copy the generated `value` (that value will be `AZURE_CLIENT_SECRET`)
 
     ![New Client Secret](./img/new-client-secret.png)
 
@@ -99,12 +95,11 @@ With this done you will have all the needed keys, summarized in the following ta
 ### Grant required API permissions
 
 Assign the following Microsoft Graph permissions:
-
-- `Directory.Read.All`: Required for all services.
+- `AuditLog.Read.All`: Required for Entra service.
+- `Domain.Read.All`: Required for all services.
 - `Policy.Read.All`: Required for all services.
-- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in.
-- `Sites.Read.All`: Required for SharePoint service.
 - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
+- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in.
 
 Follow these steps to assign the permissions:
 
@@ -117,12 +112,12 @@ Follow these steps to assign the permissions:
     ![Add API Permission](./img/add-app-api-permission.png)
 
 3. Search and select every permission below and once all are selected click on `Add permissions`:
-
-    - `Directory.Read.All`
+    - `AuditLog.Read.All`: Required for Entra service.
+    - `Domain.Read.All`
     - `Policy.Read.All`
-    - `Sites.Read.All`
     - `SharePointTenantSettings.Read.All`
 
+
     ![Permission Screenshots](./img/directory-permission.png)
 
 4. Click `Add permissions`, then grant admin consent
@@ -174,25 +169,20 @@ Follow these steps to assign the role:
 
 ---
 
-### Get your encrypted password
-
-For this step you will need to use PowerShell, here you will have to create your Encrypted Password based on the password of the User that you are going to use. For more information about how to generate this Password go [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended) and follow the steps needed to obtain `M365_ENCRYPTED_PASSWORD`.
-
----
-
 ## Step 4: Add credentials to Prowler Cloud/App
 
 1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID`
 
     ![App Overview](./img/app-overview.png)
 
+
 2. Go to Prowler Cloud/App and paste:
 
     - `Client ID`
     - `Tenant ID`
     - `AZURE_CLIENT_SECRET` from earlier
-    - `M365_USER` your user using the default domain, more info [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended)
-    - `M365_ENCRYPTED_PASSWORD` generated before
+    - `M365_USER` the user using the correct assigned domain, more info [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended)
+    - `M365_PASSWORD` the password of the user
 
     ![Prowler Cloud M365 Credentials](./img/m365-credentials.png)
 

poetry.lock

@@ -2184,6 +2184,8 @@ python-versions = "*"
 groups = ["dev"]
 files = [
     {file = "jsonpath-ng-1.7.0.tar.gz", hash = "sha256:f6f5f7fd4e5ff79c785f1573b394043b39849fb2bb47bcead935d12b00beab3c"},
+    {file = "jsonpath_ng-1.7.0-py2-none-any.whl", hash = "sha256:898c93fc173f0c336784a3fa63d7434297544b7198124a68f9a3ef9597b0ae6e"},
+    {file = "jsonpath_ng-1.7.0-py3-none-any.whl", hash = "sha256:f3d7f9e848cba1b6da28c55b1c26ff915dc9e0b1ba7e752a53d6da8d5cbd00b6"},
 ]
 
 [package.dependencies]
@@ -3969,32 +3971,6 @@ cffi = ">=1.4.1"
 docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"]
 tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"]
 
-[[package]]
-name = "pynacl"
-version = "1.5.0"
-description = "Python binding to the Networking and Cryptography (NaCl) library"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"},
-    {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"},
-    {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"},
-]
-
-[package.dependencies]
-cffi = ">=1.4.1"
-
-[package.extras]
-docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"]
-tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"]
-
 [[package]]
 name = "pyparsing"
 version = "3.2.3"

prowler/CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
-## [5.8.0] (Prowler v5.8.0)
+## [5.8.0] (Prowler v5.8.0)
 
 ### Added
 - Add CIS 1.11 compliance framework for Kubernetes. [(#7790)](https://github.com/prowler-cloud/prowler/pull/7790)
@@ -14,12 +14,24 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Add a level for Prowler ThreatScore in the accordion in Dashboard. [(#7739)](https://github.com/prowler-cloud/prowler/pull/7739)
 - Add CIS 4.0 compliance framework for GCP. [(7785)](https://github.com/prowler-cloud/prowler/pull/7785)
 - Add `repository_has_codeowners_file` check for GitHub provider. [(#7752)](https://github.com/prowler-cloud/prowler/pull/7752)
+- Add `repository_default_branch_requires_signed_commits` check for GitHub provider. [(#7777)](https://github.com/prowler-cloud/prowler/pull/7777)
+- Add `repository_inactive_not_archived` check for GitHub provider. [(#7786)](https://github.com/prowler-cloud/prowler/pull/7786)
+- Add `repository_dependency_scanning_enabled` check for GitHub provider. [(#7771)](https://github.com/prowler-cloud/prowler/pull/7771)
+- Add `repository_secret_scanning_enabled` check for GitHub provider. [(#7759)](https://github.com/prowler-cloud/prowler/pull/7759)
 - Add `repository_default_branch_requires_codeowners_review` check for GitHub provider. [(#7753)](https://github.com/prowler-cloud/prowler/pull/7753)
+- Add NIS 2 compliance framework for AWS. [(7839)](https://github.com/prowler-cloud/prowler/pull/7839)
+- Add NIS 2 compliance framework for Azure. [(7857)](https://github.com/prowler-cloud/prowler/pull/7857)
+- Add search bar in Dashboard Overview page. [(#7804)](https://github.com/prowler-cloud/prowler/pull/7804)
 
-### Fixed
+---
+
+### [v5.7.2] Fixed
 - Fix `m365_powershell test_credentials` to use sanitized credentials. [(#7761)](https://github.com/prowler-cloud/prowler/pull/7761)
 - Fix `admincenter_users_admins_reduced_license_footprint` check logic to pass when admin user has no license. [(#7779)](https://github.com/prowler-cloud/prowler/pull/7779)
 - Fix `m365_powershell` to close the PowerShell sessions in msgraph services. [(#7816)](https://github.com/prowler-cloud/prowler/pull/7816)
+- Fix `defender_ensure_notify_alerts_severity_is_high`check to accept high or lower severity. [(#7862)](https://github.com/prowler-cloud/prowler/pull/7862)
+- Replace `Directory.Read.All` permission with `Domain.Read.All` which is more restrictive. [(#7888)](https://github.com/prowler-cloud/prowler/pull/7888)
+- Split calls to list Azure Functions attributes. [(#7778)](https://github.com/prowler-cloud/prowler/pull/7778)
 
 ---
 
@@ -48,6 +60,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Update and upgrade CIS for all the providers [(#7738)](https://github.com/prowler-cloud/prowler/pull/7738)
 - Cover policies with conditions with SNS endpoint in `sns_topics_not_publicly_accessible`. [(#7750)](https://github.com/prowler-cloud/prowler/pull/7750)
 - Change severity logic for `ec2_securitygroup_allow_ingress_from_internet_to_all_ports` check. [(#7764)](https://github.com/prowler-cloud/prowler/pull/7764)
+- Automatically encrypt password in Microsoft365 provider. [(#7784)](https://github.com/prowler-cloud/prowler/pull/7784)
 
 ---
 

prowler/config/config.yaml

@@ -515,3 +515,8 @@ m365:
   # m365.exchange_mailbox_properties_auditing_enabled
   # Maximum number of days to keep audit logs
   audit_log_age: 90
+
+# GitHub Configuration
+github:
+  # github.repository_inactive_not_archived --> CIS recommends 180 days (6 months)
+  inactive_not_archived_days_threshold: 180

prowler/lib/check/models.py

@@ -329,9 +329,8 @@ class CheckMetadata(BaseModel):
         checks = set()
 
         if service:
-            # This is a special case for the AWS provider since `lambda` is a reserved keyword in Python
-            if service == "awslambda":
-                service = "lambda"
+            if service == "lambda":
+                service = "awslambda"
             checks = {
                 check_name
                 for check_name, check_metadata in bulk_checks_metadata.items()
@@ -548,7 +547,7 @@ class CheckReportGithub(Check_Report):
 
     resource_name: str
     resource_id: str
-    repository: str
+    owner: str
 
     def __init__(
         self,
@@ -556,7 +555,7 @@ class CheckReportGithub(Check_Report):
         resource: Any,
         resource_name: str = None,
         resource_id: str = None,
-        repository: str = "global",
+        owner: str = None,
     ) -> None:
         """Initialize the GitHub Check's finding information.
 
@@ -565,12 +564,16 @@ class CheckReportGithub(Check_Report):
             resource: Basic information about the resource. Defaults to None.
             resource_name: The name of the resource related with the finding.
             resource_id: The id of the resource related with the finding.
-            repository: The repository of the resource related with the finding.
+            owner: The owner of the resource related with the finding.
         """
         super().__init__(metadata, resource)
         self.resource_name = resource_name or getattr(resource, "name", "")
         self.resource_id = resource_id or getattr(resource, "id", "")
-        self.repository = repository or getattr(resource, "repository", "")
+        self.owner = (
+            owner
+            or getattr(resource, "owner", "")  # For Repositories
+            or getattr(resource, "name", "")  # For Organizations
+        )
 
 
 @dataclass

prowler/lib/outputs/finding.py

@@ -251,7 +251,7 @@ class Finding(BaseModel):
                 output_data["resource_uid"] = check_output.resource_id
                 output_data["account_name"] = provider.identity.account_name
                 output_data["account_uid"] = provider.identity.account_id
-                output_data["region"] = check_output.repository
+                output_data["region"] = check_output.owner
 
             elif provider.type == "m365":
                 output_data["auth_method"] = (

prowler/lib/outputs/outputs.py

@@ -17,7 +17,7 @@ def stdout_report(finding, color, verbose, status, fix):
     if finding.check_metadata.Provider == "kubernetes":
         details = finding.namespace.lower()
     if finding.check_metadata.Provider == "github":
-        details = finding.repository
+        details = finding.owner
     if finding.check_metadata.Provider == "m365":
         details = finding.location
     if finding.check_metadata.Provider == "nhn":

prowler/providers/aws/services/vpc/vpc_endpoint_for_ec2_enabled/vpc_endpoint_for_ec2_enabled.metadata.json

@@ -3,7 +3,7 @@
   "CheckID": "vpc_endpoint_for_ec2_enabled",
   "CheckTitle": "Amazon EC2 should be configured to use VPC endpoints that are created for the Amazon EC2 service.",
   "CheckType": [],
-  "ServiceName": "ec2",
+  "ServiceName": "vpc",
   "SubServiceName": "",
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
   "Severity": "medium",

prowler/providers/azure/services/app/app_function_access_keys_configured/app_function_access_keys_configured.py

@@ -11,19 +11,20 @@ class app_function_access_keys_configured(Check):
             functions,
         ) in app_client.functions.items():
             for function in functions.values():
-                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
-                report.subscription = subscription_name
-                report.status = "FAIL"
-                report.status_extended = (
-                    f"Function {function.name} does not have function keys configured."
-                )
-
-                if len(function.function_keys) > 0:
-                    report.status = "PASS"
-                    report.status_extended = (
-                        f"Function {function.name} has function keys configured."
+                if function.function_keys is not None:
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource=function
                     )
+                    report.subscription = subscription_name
+                    report.status = "FAIL"
+                    report.status_extended = f"Function {function.name} does not have function keys configured."
 
-                findings.append(report)
+                    if len(function.function_keys) > 0:
+                        report.status = "PASS"
+                        report.status_extended = (
+                            f"Function {function.name} has function keys configured."
+                        )
+
+                    findings.append(report)
 
         return findings

prowler/providers/azure/services/app/app_function_application_insights_enabled/app_function_application_insights_enabled.py

@@ -14,26 +14,29 @@ class app_function_application_insights_enabled(Check):
             functions,
         ) in app_client.functions.items():
             for function in functions.values():
-                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
-                report.subscription = subscription_name
-                report.status = "FAIL"
-                report.status_extended = (
-                    f"Function {function.name} is not using Application Insights."
-                )
-
-                if function.enviroment_variables.get(
-                    "APPINSIGHTS_INSTRUMENTATIONKEY", ""
-                ) in [
-                    component.instrumentation_key
-                    for component in appinsights_client.components[
-                        subscription_name
-                    ].values()
-                ]:
-                    report.status = "PASS"
+                if function.enviroment_variables is not None:
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource=function
+                    )
+                    report.subscription = subscription_name
+                    report.status = "FAIL"
                     report.status_extended = (
-                        f"Function {function.name} is using Application Insights."
+                        f"Function {function.name} is not using Application Insights."
                     )
 
-                findings.append(report)
+                    if function.enviroment_variables.get(
+                        "APPINSIGHTS_INSTRUMENTATIONKEY", ""
+                    ) in [
+                        component.instrumentation_key
+                        for component in appinsights_client.components[
+                            subscription_name
+                        ].values()
+                    ]:
+                        report.status = "PASS"
+                        report.status_extended = (
+                            f"Function {function.name} is using Application Insights."
+                        )
+
+                    findings.append(report)
 
         return findings

prowler/providers/azure/services/app/app_function_latest_runtime_version/app_function_latest_runtime_version.py

@@ -11,20 +11,25 @@ class app_function_latest_runtime_version(Check):
             functions,
         ) in app_client.functions.items():
             for function in functions.values():
-                report = Check_Report_Azure(metadata=self.metadata(), resource=function)
-                report.subscription = subscription_name
-                report.status = "PASS"
-                report.status_extended = (
-                    f"Function {function.name} is using the latest runtime."
-                )
+                if function.enviroment_variables is not None:
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource=function
+                    )
+                    report.subscription = subscription_name
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Function {function.name} is using the latest runtime."
+                    )
 
-                if (
-                    function.enviroment_variables.get("FUNCTIONS_EXTENSION_VERSION", "")
-                    != "~4"
-                ):
-                    report.status = "FAIL"
-                    report.status_extended = f"Function {function.name} is not using the latest runtime. The current runtime is '{function.enviroment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
+                    if (
+                        function.enviroment_variables.get(
+                            "FUNCTIONS_EXTENSION_VERSION", ""
+                        )
+                        != "~4"
+                    ):
+                        report.status = "FAIL"
+                        report.status_extended = f"Function {function.name} is not using the latest runtime. The current runtime is '{function.enviroment_variables.get('FUNCTIONS_EXTENSION_VERSION', '')}' and should be '~4'."
 
-                findings.append(report)
+                    findings.append(report)
 
         return findings

prowler/providers/azure/services/app/app_service.py

@@ -1,5 +1,5 @@
 from dataclasses import dataclass, field
-from typing import Dict, List
+from typing import Dict, List, Optional
 
 from azure.mgmt.web import WebSiteManagementClient
 
@@ -124,14 +124,16 @@ class App(AzureService):
                     # Filter function apps
                     if getattr(function, "kind", "").startswith("functionapp"):
                         # List host keys
-                        host_keys = client.web_apps.list_host_keys(
-                            resource_group_name=function.resource_group,
-                            name=function.name,
-                        )  # Need to add role 'Logic App Contributor' to the service principal to get the host keys or add to the reader role the permission 'Microsoft.Web/sites/host/listkeys'
+                        host_keys = self._get_function_host_keys(
+                            subscription_name, function.resource_group, function.name
+                        )
+                        if host_keys is not None:
+                            function_keys = getattr(host_keys, "function_keys", {})
+                        else:
+                            function_keys = None
 
-                        function_config = client.web_apps.get_configuration(
-                            resource_group_name=function.resource_group,
-                            name=function.name,
+                        function_config = self._get_function_config(
+                            subscription_name, function.resource_group, function.name
                         )
 
                         functions[subscription_name].update(
@@ -141,16 +143,9 @@ class App(AzureService):
                                     name=function.name,
                                     location=function.location,
                                     kind=function.kind,
-                                    function_keys=getattr(
-                                        host_keys, "function_keys", {}
-                                    ),
+                                    function_keys=function_keys,
                                     enviroment_variables=getattr(
-                                        client.web_apps.list_application_settings(
-                                            resource_group_name=function.resource_group,
-                                            name=function.name,
-                                        ),
-                                        "properties",
-                                        {},
+                                        function_config, "properties", None
                                     ),
                                     identity=getattr(function, "identity", None),
                                     public_access=(
@@ -167,7 +162,7 @@ class App(AzureService):
                                         "",
                                     ),
                                     ftps_state=getattr(
-                                        function_config, "ftps_state", ""
+                                        function_config, "ftps_state", None
                                     ),
                                 )
                             }
@@ -209,6 +204,30 @@ class App(AzureService):
             )
         return monitor_diagnostics_settings
 
+    def _get_function_host_keys(self, subscription, resource_group, name):
+        try:
+            return self.clients[subscription].web_apps.list_host_keys(
+                resource_group_name=resource_group,
+                name=name,
+            )
+        except Exception as error:
+            logger.error(
+                f"Error getting host keys for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return None
+
+    def _get_function_config(self, subscription, resource_group, name):
+        try:
+            return self.clients[subscription].web_apps.list_application_settings(
+                resource_group_name=resource_group,
+                name=name,
+            )
+        except Exception as error:
+            logger.error(
+                f"Error getting configuration for {name} in {resource_group}: {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            return None
+
 
 @dataclass
 class ManagedServiceIdentity:
@@ -250,9 +269,9 @@ class FunctionApp:
     name: str
     location: str
     kind: str
-    function_keys: Dict[str, str]
-    enviroment_variables: Dict[str, str]
+    function_keys: Optional[Dict[str, str]]
+    enviroment_variables: Optional[Dict[str, str]]
     identity: ManagedServiceIdentity
     public_access: bool
     vnet_subnet_id: str
-    ftps_state: str
+    ftps_state: Optional[str]

prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.metadata.json

@@ -1,16 +1,16 @@
 {
   "Provider": "azure",
   "CheckID": "defender_ensure_notify_alerts_severity_is_high",
-  "CheckTitle": "Ensure That 'Notify about alerts with the following severity' is Set to 'High'",
+  "CheckTitle": "Ensure that email notifications are configured for alerts with a minimum severity of 'High' or lower",
   "CheckType": [],
   "ServiceName": "defender",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "high",
   "ResourceType": "AzureEmailNotifications",
-  "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.",
-  "Risk": "Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details",
+  "Description": "Microsoft Defender for Cloud sends email notifications when alerts of a certain severity level or higher are triggered. By setting the minimum severity to 'High', 'Medium', or even 'Low', you ensure that alerts with equal or greater severity (e.g., High or Critical) are still delivered. Selecting a lower threshold like 'Low' results in more comprehensive alert coverage.",
+  "Risk": "If this setting is too restrictive (e.g., set to 'Critical' only), important security alerts with 'High' or 'Medium' severity might be missed. Ensuring that 'High' or a lower threshold is configured helps security teams stay informed about significant threats and respond in a timely manner.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/email-notifications-alerts#manage-notifications-on-email",
   "Remediation": {
     "Code": {
       "CLI": "",
@@ -19,7 +19,7 @@
       "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/bc_azr_general_4#terraform"
     },
     "Recommendation": {
-      "Text": "1. From Azure Home select the Portal Menu 2. Select Microsoft Defender for Cloud 3. Click on Environment Settings 4. Click on the appropriate Management Group, Subscription, or Workspace 5. Click on Email notifications 6. Enter a valid security contact email address (or multiple addresses separated by commas) in the Additional email addresses field 7. Click Save",
+      "Text": "1. From Azure Home select the Portal Menu. 2. Select Microsoft Defender for Cloud. 3. Click on Environment Settings. 4. Click on the appropriate Management Group, Subscription, or Workspace. 5. Click on Email notifications. 6. Under 'Notify about alerts with the following severity (or higher)', select at least 'High' (or optionally 'Medium' or 'Low' for broader coverage). 7. Click Save.",
       "Url": "https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list"
     }
   },

prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.py

@@ -13,12 +13,15 @@ class defender_ensure_notify_alerts_severity_is_high(Check):
             for contact in security_contacts.values():
                 report = Check_Report_Azure(metadata=self.metadata(), resource=contact)
                 report.subscription = subscription_name
-                report.status = "PASS"
-                report.status_extended = f"Notifiy alerts are enabled for severity high in subscription {subscription_name}."
+                report.status = "FAIL"
+                report.status_extended = f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {subscription_name}."
 
-                if contact.alert_notifications_minimal_severity != "High":
-                    report.status = "FAIL"
-                    report.status_extended = f"Notifiy alerts are not enabled for severity high in subscription {subscription_name}."
+                if (
+                    contact.alert_notifications_minimal_severity != "Critical"
+                    and contact.alert_notifications_minimal_severity != ""
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"Notifications are enabled for alerts with a minimum severity of high or lower ({contact.alert_notifications_minimal_severity}) in subscription {subscription_name}."
 
                 findings.append(report)
 

prowler/providers/azure/services/sqlserver/sqlserver_auditing_enabled/sqlserver_auditing_enabled.py

@@ -12,7 +12,7 @@ class sqlserver_auditing_enabled(Check):
                 )
                 report.subscription = subscription
                 report.status = "PASS"
-                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has a auditing policy configured."
+                report.status_extended = f"SQL Server {sql_server.name} from subscription {subscription} has an auditing policy configured."
                 for auditing_policy in sql_server.auditing_policies:
                     if auditing_policy.state == "Disabled":
                         report.status = "FAIL"

prowler/providers/gcp/gcp_provider.py

@@ -515,9 +515,9 @@ class GcpProvider(Provider):
                     credentials=session,
                 )
 
-            # Test the connection using the Service Usage API since it is enabled by default
-            client = discovery.build("serviceusage", "v1", credentials=session)
-            request = client.services().list(parent=f"projects/{project_id}")
+            # Test the connection using OAuth2 API to verify token validity
+            client = discovery.build("oauth2", "v2", credentials=session)
+            request = client.tokeninfo()
             request.execute()
             return Connection(is_connected=True)
 

prowler/providers/github/github_provider.py

@@ -4,6 +4,7 @@ from typing import Union
 
 from colorama import Fore, Style
 from github import Auth, Github, GithubIntegration
+from github.GithubRetry import GithubRetry
 
 from prowler.config.config import (
     default_config_file_path,
@@ -300,9 +301,10 @@ class GithubProvider(Provider):
         credentials = self.session
 
         try:
+            retry_config = GithubRetry(total=3)
             if credentials.token:
                 auth = Auth.Token(credentials.token)
-                g = Github(auth=auth)
+                g = Github(auth=auth, retry=retry_config)
                 try:
                     identity = GithubIdentityInfo(
                         account_id=g.get_user().id,
@@ -318,7 +320,7 @@ class GithubProvider(Provider):
 
             elif credentials.id != 0 and credentials.key:
                 auth = Auth.AppAuth(credentials.id, credentials.key)
-                gi = GithubIntegration(auth=auth)
+                gi = GithubIntegration(auth=auth, retry=retry_config)
                 try:
                     identity = GithubAppIdentityInfo(app_id=gi.get_app().id)
                     return identity

prowler/providers/github/lib/service/service.py

@@ -1,4 +1,5 @@
 from github import Auth, Github, GithubIntegration
+from github.GithubRetry import GithubRetry
 
 from prowler.lib.logger import logger
 from prowler.providers.github.github_provider import GithubProvider
@@ -20,16 +21,17 @@ class GithubService:
     def __set_clients__(self, session):
         clients = []
         try:
+            retry_config = GithubRetry(total=3)
             if session.token:
                 auth = Auth.Token(session.token)
-                clients = [Github(auth=auth)]
+                clients = [Github(auth=auth, retry=retry_config)]
 
             elif session.key and session.id:
                 auth = Auth.AppAuth(
                     session.id,
                     session.key,
                 )
-                gi = GithubIntegration(auth=auth)
+                gi = GithubIntegration(auth=auth, retry=retry_config)
 
                 for installation in gi.get_installations():
                     clients.append(installation.get_github_for_installation())

prowler/providers/github/services/repository/repository_branch_delete_on_merge_enabled/repository_branch_delete_on_merge_enabled.py

@@ -22,19 +22,13 @@ class repository_branch_delete_on_merge_enabled(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            report = CheckReportGithub(
-                metadata=self.metadata(), resource=repo, repository=repo.name
-            )
+            report = CheckReportGithub(metadata=self.metadata(), resource=repo)
             report.status = "FAIL"
-            report.status_extended = (
-                f"Repository {repo.name} does not delete branches on merge."
-            )
+            report.status_extended = f"Repository {repo.name} does not delete branches on merge in default branch ({repo.default_branch.name})."
 
             if repo.delete_branch_on_merge:
                 report.status = "PASS"
-                report.status_extended = (
-                    f"Repository {repo.name} does delete branches on merge."
-                )
+                report.status_extended = f"Repository {repo.name} does delete branches on merge in default branch ({repo.default_branch.name})."
 
             findings.append(report)
 

prowler/providers/github/services/repository/repository_default_branch_deletion_disabled/repository_default_branch_deletion_disabled.py

@@ -22,16 +22,14 @@ class repository_default_branch_deletion_disabled(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.default_branch_deletion is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.branch_deletion is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
                 report.status_extended = (
                     f"Repository {repo.name} does allow default branch deletion."
                 )
 
-                if not repo.default_branch_deletion:
+                if not repo.default_branch.branch_deletion:
                     report.status = "PASS"
                     report.status_extended = (
                         f"Repository {repo.name} does deny default branch deletion."

prowler/providers/github/services/repository/repository_default_branch_disallows_force_push/repository_default_branch_disallows_force_push.py

@@ -22,20 +22,14 @@ class repository_default_branch_disallows_force_push(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.allow_force_pushes is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.allow_force_pushes is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
-                report.status_extended = (
-                    f"Repository {repo.name} does allow force push."
-                )
+                report.status_extended = f"Repository {repo.name} does allow force pushes on default branch ({repo.default_branch.name})."
 
-                if not repo.allow_force_pushes:
+                if not repo.default_branch.allow_force_pushes:
                     report.status = "PASS"
-                    report.status_extended = (
-                        f"Repository {repo.name} does deny force push."
-                    )
+                    report.status_extended = f"Repository {repo.name} does deny force pushes on default branch ({repo.default_branch.name})."
 
                 findings.append(report)
 

prowler/providers/github/services/repository/repository_default_branch_protection_applies_to_admins/repository_default_branch_protection_applies_to_admins.py

@@ -22,14 +22,12 @@ class repository_default_branch_protection_applies_to_admins(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.enforce_admins is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.enforce_admins is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
                 report.status_extended = f"Repository {repo.name} does not enforce administrators to be subject to the same branch protection rules as other users."
 
-                if repo.enforce_admins:
+                if repo.default_branch.enforce_admins:
                     report.status = "PASS"
                     report.status_extended = f"Repository {repo.name} does enforce administrators to be subject to the same branch protection rules as other users."
 

prowler/providers/github/services/repository/repository_default_branch_protection_enabled/repository_default_branch_protection_enabled.py

@@ -22,16 +22,14 @@ class repository_default_branch_protection_enabled(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.default_branch_protection is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.protected is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
-                report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch})."
+                report.status_extended = f"Repository {repo.name} does not enforce branch protection on default branch ({repo.default_branch.name})."
 
-                if repo.default_branch_protection:
+                if repo.default_branch.protected:
                     report.status = "PASS"
-                    report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch})."
+                    report.status_extended = f"Repository {repo.name} does enforce branch protection on default branch ({repo.default_branch.name})."
 
                 findings.append(report)
 

prowler/providers/github/services/repository/repository_default_branch_requires_codeowners_review/repository_default_branch_requires_codeowners_review.py

@@ -22,11 +22,9 @@ class repository_default_branch_requires_codeowners_review(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.require_code_owner_reviews is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
-                if repo.require_code_owner_reviews:
+            if repo.default_branch.require_code_owner_reviews is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
+                if repo.default_branch.require_code_owner_reviews:
                     report.status = "PASS"
                     report.status_extended = f"Repository {repo.name} requires code owner approval for changes to owned code."
                 else:

prowler/providers/github/services/repository/repository_default_branch_requires_conversation_resolution/repository_default_branch_requires_conversation_resolution.py

@@ -22,20 +22,14 @@ class repository_default_branch_requires_conversation_resolution(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.conversation_resolution is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.conversation_resolution is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
-                report.status_extended = (
-                    f"Repository {repo.name} does not require conversation resolution."
-                )
+                report.status_extended = f"Repository {repo.name} does not require conversation resolution on default branch ({repo.default_branch.name})."
 
-                if repo.conversation_resolution:
+                if repo.default_branch.conversation_resolution:
                     report.status = "PASS"
-                    report.status_extended = (
-                        f"Repository {repo.name} does require conversation resolution."
-                    )
+                    report.status_extended = f"Repository {repo.name} does require conversation resolution on default branch ({repo.default_branch.name})."
 
                 findings.append(report)
 

prowler/providers/github/services/repository/repository_default_branch_requires_linear_history/repository_default_branch_requires_linear_history.py

@@ -22,16 +22,14 @@ class repository_default_branch_requires_linear_history(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.required_linear_history is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.required_linear_history is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
-                report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch})."
+                report.status_extended = f"Repository {repo.name} does not require linear history on default branch ({repo.default_branch.name})."
 
-                if repo.required_linear_history:
+                if repo.default_branch.required_linear_history:
                     report.status = "PASS"
-                    report.status_extended = f"Repository {repo.name} does require linear history on default branch ({repo.default_branch})."
+                    report.status_extended = f"Repository {repo.name} does require linear history on default branch ({repo.default_branch.name})."
 
                 findings.append(report)
 

prowler/providers/github/services/repository/repository_default_branch_requires_multiple_approvals/repository_default_branch_requires_multiple_approvals.py

@@ -22,14 +22,12 @@ class repository_default_branch_requires_multiple_approvals(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.approval_count is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.approval_count is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "FAIL"
                 report.status_extended = f"Repository {repo.name} does not enforce at least 2 approvals for code changes."
 
-                if repo.approval_count >= 2:
+                if repo.default_branch.approval_count >= 2:
                     report.status = "PASS"
                     report.status_extended = f"Repository {repo.name} does enforce at least 2 approvals for code changes."
 

prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_default_branch_requires_signed_commits",
+  "CheckTitle": "Check if repository requires signed commits",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "medium",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that every commit in a pull request is signed and verified before merging to the default branch.",
+  "Risk": "If repositories do not require signed commits, there is no way to verify the authenticity and integrity of code changes. This could allow malicious actors to impersonate legitimate contributors and introduce unauthorized or harmful changes to the codebase.",
+  "RelatedUrl": "https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable the 'Require signed commits' option in branch protection rules to ensure that all commits are cryptographically signed and verified before they can be merged.",
+      "Url": "https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-signed-commits"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_default_branch_requires_signed_commits/repository_default_branch_requires_signed_commits.py

@@ -0,0 +1,36 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_default_branch_requires_signed_commits(Check):
+    """Check if a repository requires signed commits
+
+    This class verifies whether each repository requires signed commits for the default branch.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Requires Signed Commits check
+
+        Iterates over all repositories and checks if they require signed commits.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.default_branch.require_signed_commits is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} does not require signed commits on default branch ({repo.default_branch.name})."
+
+                if repo.default_branch.require_signed_commits:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} does require signed commits on default branch ({repo.default_branch.name})."
+
+                findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_default_branch_status_checks_required/repository_default_branch_status_checks_required.py

@@ -22,16 +22,14 @@ class repository_default_branch_status_checks_required(Check):
         """
         findings = []
         for repo in repository_client.repositories.values():
-            if repo.status_checks is not None:
-                report = CheckReportGithub(
-                    self.metadata(), resource=repo, repository=repo.name
-                )
+            if repo.default_branch.status_checks is not None:
+                report = CheckReportGithub(self.metadata(), resource=repo)
                 report.status = "FAIL"
                 report.status_extended = (
                     f"Repository {repo.name} does not enforce status checks."
                 )
 
-                if repo.status_checks:
+                if repo.default_branch.status_checks:
                     report.status = "PASS"
                     report.status_extended = (
                         f"Repository {repo.name} does enforce status checks."

prowler/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_dependency_scanning_enabled",
+  "CheckTitle": "Check if package vulnerability scanning is enabled for dependencies in the repository",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "high",
+  "ResourceType": "GitHubRepository",
+  "Description": "Implement scanning tools to detect, prevent, and monitor known open-source vulnerabilities in packages used within the organization's projects. This check verifies that dependency/package vulnerability scanning (e.g., Dependabot alerts) is enabled for the repository.",
+  "Risk": "If package vulnerability scanning is not enabled, known vulnerabilities in dependencies may go undetected, increasing the risk of exploitation and security breaches.",
+  "RelatedUrl": "https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable Dependabot alerts or another package vulnerability scanner in the repository settings to automatically detect and alert on vulnerable dependencies.",
+      "Url": "https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_dependency_scanning_enabled/repository_dependency_scanning_enabled.py

@@ -0,0 +1,36 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_dependency_scanning_enabled(Check):
+    """Check if package vulnerability scanning (Dependabot alerts) is enabled for dependencies in the repository
+
+    This class verifies whether each repository has package vulnerability scanning enabled.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Package Vulnerabilities Scanner check
+
+        Iterates over all repositories and checks if package vulnerability scanning is enabled.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.dependabot_alerts_enabled is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
+                if repo.dependabot_alerts_enabled:
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} has package vulnerability scanning (Dependabot alerts) enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Repository {repo.name} does not have package vulnerability scanning (Dependabot alerts) enabled."
+
+                findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_has_codeowners_file/repository_has_codeowners_file.py

@@ -23,9 +23,7 @@ class repository_has_codeowners_file(Check):
         findings = []
         for repo in repository_client.repositories.values():
             if repo.codeowners_exists is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 if repo.codeowners_exists:
                     report.status = "PASS"
                     report.status_extended = (

prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_inactive_not_archived",
+  "CheckTitle": "Check for inactive repositories that are not archived",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that repositories with no activity are reviewed and considered for archival. Inactive repositories may have outdated dependencies or security configurations that could pose security risks.",
+  "Risk": "Inactive repositories that are not archived may contain outdated dependencies, unpatched vulnerabilities, or misconfigured security settings. These repositories increase the attack surface and could be targeted by malicious actors.",
+  "RelatedUrl": "https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Review inactive repositories and either: 1) Archive them if they are no longer needed, 2) Update their dependencies and security configurations if they are still required, or 3) Delete them if they contain no valuable information.",
+      "Url": "https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_inactive_not_archived/repository_inactive_not_archived.py

@@ -0,0 +1,43 @@
+from datetime import datetime, timezone
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_inactive_not_archived(Check):
+    """Check if unarchived repositories have been inactive for more than 6 months."""
+
+    def execute(self) -> List[CheckReportGithub]:
+        findings = []
+
+        now = datetime.now(timezone.utc)
+
+        days_threshold = repository_client.audit_config.get(
+            "inactive_not_archived_days_threshold", 180
+        )
+
+        for repo in repository_client.repositories.values():
+            report = CheckReportGithub(metadata=self.metadata(), resource=repo)
+
+            if repo.archived:
+                report.status = "PASS"
+                report.status_extended = f"Repository {repo.name} is properly archived."
+                findings.append(report)
+                continue
+
+            latest_activity = repo.pushed_at
+            days_inactive = (now - latest_activity).days
+
+            if days_inactive >= days_threshold:
+                report.status = "FAIL"
+                report.status_extended = f"Repository {repo.name} has been inactive for {days_inactive} days and is not archived (threshold: {days_threshold} days)."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Repository {repo.name} has been active within the last {days_threshold} days ({days_inactive} days ago)."
+
+            findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_public_has_securitymd_file/repository_public_has_securitymd_file.py

@@ -23,9 +23,7 @@ class repository_public_has_securitymd_file(Check):
         findings = []
         for repo in repository_client.repositories.values():
             if not repo.private and repo.securitymd is not None:
-                report = CheckReportGithub(
-                    metadata=self.metadata(), resource=repo, repository=repo.name
-                )
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                 report.status = "PASS"
                 report.status_extended = (
                     f"Repository {repo.name} does have a SECURITY.md file."

prowler/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "github",
+  "CheckID": "repository_secret_scanning_enabled",
+  "CheckTitle": "Check if secret scanning is enabled to detect sensitive data in the repository",
+  "CheckType": [],
+  "ServiceName": "repository",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "github:user-id:repository/repository-name",
+  "Severity": "high",
+  "ResourceType": "GitHubRepository",
+  "Description": "Ensure that scanners are in place to detect and prevent sensitive data, such as confidential ID numbers, passwords, and other sensitive information, from being committed in the source code. This check verifies that secret scanning is enabled to identify and prevent sensitive data from being included in the repository.",
+  "Risk": "If secret scanning is not enabled, sensitive data may be inadvertently committed to the repository, increasing the risk of data breaches and exploitation by attackers.",
+  "RelatedUrl": "https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable secret scanning in the repository settings to automatically detect and prevent sensitive data from being committed to the codebase.",
+      "Url": "https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/github/services/repository/repository_secret_scanning_enabled/repository_secret_scanning_enabled.py

@@ -0,0 +1,36 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportGithub
+from prowler.providers.github.services.repository.repository_client import (
+    repository_client,
+)
+
+
+class repository_secret_scanning_enabled(Check):
+    """Check if secret scanning is enabled to detect sensitive data in the repository
+
+    This class verifies whether each repository has secret scanning enabled.
+    """
+
+    def execute(self) -> List[CheckReportGithub]:
+        """Execute the Github Repository Secret Scanning check
+
+        Iterates over all repositories and checks if secret scanning is enabled.
+
+        Returns:
+            List[CheckReportGithub]: A list of reports for each repository
+        """
+        findings = []
+        for repo in repository_client.repositories.values():
+            if repo.secret_scanning_enabled is not None:
+                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
+                if getattr(repo, "secret_scanning_enabled", None):
+                    report.status = "PASS"
+                    report.status_extended = f"Repository {repo.name} has secret scanning enabled to detect sensitive data."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Repository {repo.name} does not have secret scanning enabled to detect sensitive data."
+
+                findings.append(report)
+
+        return findings

prowler/providers/github/services/repository/repository_service.py

@@ -1,3 +1,4 @@
+from datetime import datetime
 from typing import Optional
 
 from pydantic import BaseModel
@@ -61,6 +62,7 @@ class Repository(GithubService):
                     allow_force_pushes = True
                     branch_deletion = True
                     require_code_owner_reviews = False
+                    require_signed_commits = False
                     status_checks = False
                     enforce_admins = False
                     conversation_resolution = False
@@ -95,6 +97,9 @@ class Repository(GithubService):
                                     if require_pr
                                     else False
                                 )
+                                require_signed_commits = (
+                                    branch.get_required_signatures()
+                                )
                     except Exception as error:
                         # If the branch is not found, it is not protected
                         if "404" in str(error):
@@ -110,6 +115,7 @@ class Repository(GithubService):
                             allow_force_pushes = None
                             branch_deletion = None
                             require_code_owner_reviews = None
+                            require_signed_commits = None
                             status_checks = None
                             enforce_admins = None
                             conversation_resolution = None
@@ -117,24 +123,68 @@ class Repository(GithubService):
                                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                             )
 
+                    secret_scanning_enabled = False
+                    dependabot_alerts_enabled = False
+                    try:
+                        if (
+                            repo.security_and_analysis
+                            and repo.security_and_analysis.secret_scanning
+                        ):
+                            secret_scanning_enabled = (
+                                repo.security_and_analysis.secret_scanning.status
+                                == "enabled"
+                            )
+                        try:
+                            # Use get_dependabot_alerts to check if Dependabot alerts are enabled
+                            repo.get_dependabot_alerts().totalCount
+                            # If the call succeeds, Dependabot is enabled (even if no alerts)
+                            dependabot_alerts_enabled = True
+                        except Exception as error:
+                            error_str = str(error)
+                            if (
+                                "403" in error_str
+                                and "Dependabot alerts are disabled for this repository."
+                                in error_str
+                            ):
+                                dependabot_alerts_enabled = False
+                            else:
+                                logger.error(
+                                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                                )
+                                dependabot_alerts_enabled = None
+                    except Exception as error:
+                        logger.error(
+                            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+                        secret_scanning_enabled = None
+                        dependabot_alerts_enabled = None
                     repos[repo.id] = Repo(
                         id=repo.id,
                         name=repo.name,
+                        owner=repo.owner.login,
                         full_name=repo.full_name,
-                        default_branch=repo.default_branch,
+                        default_branch=Branch(
+                            name=default_branch,
+                            protected=branch_protection,
+                            default_branch=True,
+                            require_pull_request=require_pr,
+                            approval_count=approval_cnt,
+                            required_linear_history=required_linear_history,
+                            allow_force_pushes=allow_force_pushes,
+                            branch_deletion=branch_deletion,
+                            status_checks=status_checks,
+                            enforce_admins=enforce_admins,
+                            conversation_resolution=conversation_resolution,
+                            require_code_owner_reviews=require_code_owner_reviews,
+                            require_signed_commits=require_signed_commits,
+                        ),
                         private=repo.private,
+                        archived=repo.archived,
+                        pushed_at=repo.pushed_at,
                         securitymd=securitymd_exists,
-                        require_pull_request=require_pr,
-                        approval_count=approval_cnt,
-                        required_linear_history=required_linear_history,
-                        allow_force_pushes=allow_force_pushes,
-                        default_branch_deletion=branch_deletion,
-                        status_checks=status_checks,
-                        enforce_admins=enforce_admins,
-                        conversation_resolution=conversation_resolution,
-                        default_branch_protection=branch_protection,
                         codeowners_exists=codeowners_exists,
-                        require_code_owner_reviews=require_code_owner_reviews,
+                        secret_scanning_enabled=secret_scanning_enabled,
+                        dependabot_alerts_enabled=dependabot_alerts_enabled,
                         delete_branch_on_merge=delete_branch_on_merge,
                     )
 
@@ -145,24 +195,37 @@ class Repository(GithubService):
         return repos
 
 
+class Branch(BaseModel):
+    """Model for Github Branch"""
+
+    name: str
+    protected: bool
+    default_branch: bool
+    require_pull_request: Optional[bool]
+    approval_count: Optional[int]
+    required_linear_history: Optional[bool]
+    allow_force_pushes: Optional[bool]
+    branch_deletion: Optional[bool]
+    status_checks: Optional[bool]
+    enforce_admins: Optional[bool]
+    require_code_owner_reviews: Optional[bool]
+    require_signed_commits: Optional[bool]
+    conversation_resolution: Optional[bool]
+
+
 class Repo(BaseModel):
     """Model for Github Repository"""
 
     id: int
     name: str
+    owner: str
     full_name: str
-    default_branch_protection: Optional[bool]
-    default_branch: str
+    default_branch: Branch
     private: bool
+    archived: bool
+    pushed_at: datetime
     securitymd: Optional[bool]
-    require_pull_request: Optional[bool]
-    required_linear_history: Optional[bool]
-    allow_force_pushes: Optional[bool]
-    default_branch_deletion: Optional[bool]
-    status_checks: Optional[bool]
-    enforce_admins: Optional[bool]
-    approval_count: Optional[int]
     codeowners_exists: Optional[bool]
-    require_code_owner_reviews: Optional[bool]
+    secret_scanning_enabled: Optional[bool]
+    dependabot_alerts_enabled: Optional[bool]
     delete_branch_on_merge: Optional[bool]
-    conversation_resolution: Optional[bool]

prowler/providers/m365/exceptions/exceptions.py

@@ -106,9 +106,9 @@ class M365BaseException(ProwlerException):
             "message": "The provided User is not valid.",
             "remediation": "Check the User and ensure it is a valid user.",
         },
-        (6025, "M365NotValidEncryptedPasswordError"): {
-            "message": "The provided Encrypted Password is not valid.",
-            "remediation": "Check the Encrypted Password and ensure it is a valid password.",
+        (6025, "M365NotValidPasswordError"): {
+            "message": "The provided Password is not valid.",
+            "remediation": "Check the Password and ensure it is a valid password.",
         },
         (6026, "M365UserNotBelongingToTenantError"): {
             "message": "The provided User does not belong to the specified tenant.",
@@ -312,7 +312,7 @@ class M365NotValidUserError(M365CredentialsError):
         )
 
 
-class M365NotValidEncryptedPasswordError(M365CredentialsError):
+class M365NotValidPasswordError(M365CredentialsError):
     def __init__(self, file=None, original_exception=None, message=None):
         super().__init__(
             6025, file=file, original_exception=original_exception, message=message

prowler/providers/m365/lib/powershell/m365_powershell.py

@@ -1,4 +1,5 @@
 import os
+import platform
 
 import msal
 
@@ -64,17 +65,59 @@ class M365PowerShell(PowerShellSession):
             The credentials are sanitized to prevent command injection and
             stored securely in the PowerShell session.
         """
+
+        credentials.encrypted_passwd = self.encrypt_password(credentials.passwd)
+
         # Sanitize user and password
-        user = self.sanitize(credentials.user)
-        passwd = self.sanitize(credentials.passwd)
+        sanitized_user = self.sanitize(credentials.user)
+        sanitized_encrypted_passwd = self.sanitize(credentials.encrypted_passwd)
 
         # Securely convert encrypted password to SecureString
-        self.execute(f'$user = "{user}"')
-        self.execute(f'$secureString = "{passwd}" | ConvertTo-SecureString')
+        self.execute(f'$user = "{sanitized_user}"')
+        self.execute(
+            f'$secureString = "{sanitized_encrypted_passwd}" | ConvertTo-SecureString'
+        )
         self.execute(
             "$credential = New-Object System.Management.Automation.PSCredential ($user, $secureString)"
         )
 
+    def encrypt_password(self, password: str) -> str:
+        """
+        Encrypts a password using Windows CryptProtectData on Windows systems
+        or UTF-16LE encoding on other systems.
+
+        Args:
+        password (str): The password to encrypt
+
+        Returns:
+        str: The encrypted password in hexadecimal format
+
+        Raises:
+        ValueError: If password is None or empty
+        """
+        try:
+            if platform.system() == "Windows":
+                import win32crypt
+
+                encrypted_blob = win32crypt.CryptProtectData(
+                    password.encode("utf-16le"), None, None, None, None, 0
+                )
+
+                encrypted_bytes = encrypted_blob
+                if isinstance(encrypted_blob, tuple):
+                    encrypted_bytes = encrypted_blob[1]
+                elif hasattr(encrypted_blob, "data"):
+                    encrypted_bytes = encrypted_blob.data
+
+                return encrypted_bytes.hex()
+
+            else:
+                return password.encode("utf-16le").hex()
+        except Exception as error:
+            raise Exception(
+                f"[{os.path.basename(__file__)}] Error encrypting password: {str(error)}"
+            )
+
     def test_credentials(self, credentials: M365Credentials) -> bool:
         """
         Test Microsoft 365 credentials by attempting to authenticate against Entra ID.
@@ -87,14 +130,11 @@ class M365PowerShell(PowerShellSession):
             bool: True if credentials are valid and authentication succeeds, False otherwise.
         """
         self.execute(
-            f'$securePassword = "{self.sanitize(credentials.passwd)}" | ConvertTo-SecureString'
+            f'$securePassword = "{credentials.encrypted_passwd}" | ConvertTo-SecureString'  # encrypted password already sanitized
         )
         self.execute(
             f'$credential = New-Object System.Management.Automation.PSCredential("{self.sanitize(credentials.user)}", $securePassword)'
         )
-        decrypted_password = self.execute(
-            'Write-Output "$($credential.GetNetworkCredential().Password)"'
-        )
 
         # Validate user belongs to tenant
         user_domain = credentials.user.split("@")[1]
@@ -116,7 +156,7 @@ class M365PowerShell(PowerShellSession):
         # Validate credentials
         result = app.acquire_token_by_username_password(
             username=credentials.user,
-            password=decrypted_password,  # Needs to be in plain text
+            password=credentials.passwd,
             scopes=["https://graph.microsoft.com/.default"],
         )
 

prowler/providers/m365/m365_provider.py

@@ -43,7 +43,7 @@ from prowler.providers.m365.exceptions.exceptions import (
     M365NotTenantIdButClientIdAndClientSecretError,
     M365NotValidClientIdError,
     M365NotValidClientSecretError,
-    M365NotValidEncryptedPasswordError,
+    M365NotValidPasswordError,
     M365NotValidTenantIdError,
     M365NotValidUserError,
     M365SetUpRegionConfigError,
@@ -117,7 +117,7 @@ class M365Provider(Provider):
         client_id: str = None,
         client_secret: str = None,
         user: str = None,
-        encrypted_password: str = None,
+        password: str = None,
         init_modules: bool = False,
         region: str = "M365Global",
         config_content: dict = None,
@@ -164,7 +164,7 @@ class M365Provider(Provider):
             client_id,
             client_secret,
             user,
-            encrypted_password,
+            password,
         )
 
         logger.info("Checking if region is different than default one")
@@ -172,13 +172,13 @@ class M365Provider(Provider):
 
         # Get the dict from the static credentials
         m365_credentials = None
-        if tenant_id and client_id and client_secret and user and encrypted_password:
+        if tenant_id and client_id and client_secret and user and password:
             m365_credentials = self.validate_static_credentials(
                 tenant_id=tenant_id,
                 client_id=client_id,
                 client_secret=client_secret,
                 user=user,
-                encrypted_password=encrypted_password,
+                password=password,
             )
 
         # Set up the M365 session
@@ -282,7 +282,7 @@ class M365Provider(Provider):
         client_id: str,
         client_secret: str,
         user: str,
-        encrypted_password: str,
+        password: str,
     ):
         """
         Validates the authentication arguments for the M365 provider.
@@ -296,7 +296,7 @@ class M365Provider(Provider):
             client_id (str): The M365 Client ID.
             client_secret (str): The M365 Client Secret.
             user (str): The M365 User Account.
-            encrpted_password (str): The M365 Encrypted Password.
+            password (str): The M365 User Password.
 
         Raises:
             M365BrowserAuthNoTenantIDError: If browser authentication is enabled but the tenant ID is not found.
@@ -324,10 +324,10 @@ class M365Provider(Provider):
                     message="M365 Tenant ID (--tenant-id) is required for browser authentication mode",
                 )
         elif env_auth:
-            if not user or not encrypted_password or not tenant_id:
+            if not user or not password or not tenant_id:
                 raise M365MissingEnvironmentCredentialsError(
                     file=os.path.basename(__file__),
-                    message="M365 provider requires AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, M365_USER and M365_ENCRYPTED_PASSWORD environment variables to be set when using --env-auth",
+                    message="M365 provider requires AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, M365_USER and M365_PASSWORD environment variables to be set when using --env-auth",
                 )
         else:
             if not tenant_id:
@@ -396,7 +396,7 @@ class M365Provider(Provider):
         if m365_credentials:
             credentials = M365Credentials(
                 user=m365_credentials.get("user", ""),
-                passwd=m365_credentials.get("encrypted_password", ""),
+                passwd=m365_credentials.get("password", ""),
                 client_id=m365_credentials.get("client_id", ""),
                 client_secret=m365_credentials.get("client_secret", ""),
                 tenant_id=m365_credentials.get("tenant_id", ""),
@@ -404,18 +404,18 @@ class M365Provider(Provider):
             )
         elif env_auth:
             m365_user = getenv("M365_USER")
-            m365_password = getenv("M365_ENCRYPTED_PASSWORD")
+            m365_password = getenv("M365_PASSWORD")
             client_id = getenv("AZURE_CLIENT_ID")
             client_secret = getenv("AZURE_CLIENT_SECRET")
             tenant_id = getenv("AZURE_TENANT_ID")
 
             if not m365_user or not m365_password:
                 logger.critical(
-                    "M365 provider: Missing M365_USER or M365_ENCRYPTED_PASSWORD environment variables needed for credentials authentication"
+                    "M365 provider: Missing M365_USER or M365_PASSWORD environment variables needed for credentials authentication"
                 )
                 raise M365MissingEnvironmentCredentialsError(
                     file=os.path.basename(__file__),
-                    message="Missing M365_USER or M365_ENCRYPTED_PASSWORD environment variables required for credentials authentication.",
+                    message="Missing M365_USER or M365_PASSWORD environment variables required for credentials authentication.",
                 )
             credentials = M365Credentials(
                 client_id=client_id,
@@ -494,7 +494,7 @@ class M365Provider(Provider):
                 - client_id: The M365 client ID.
                 - client_secret: The M365 client secret
                 - user: The M365 user email
-                - encrypted_password: The M365 encrypted password
+                - password: The M365 user password
                 - provider_id: The M365 provider ID (in this case the Tenant ID).
             region_config (M365RegionConfig): The region configuration object.
 
@@ -621,7 +621,7 @@ class M365Provider(Provider):
         client_id: str = None,
         client_secret: str = None,
         user: str = None,
-        encrypted_password: str = None,
+        password: str = None,
         provider_id: str = None,
     ) -> Connection:
         """Test connection to M365 tenant and PowerShell modules.
@@ -640,7 +640,7 @@ class M365Provider(Provider):
             client_id (str): The M365 client ID.
             client_secret (str): The M365 client secret.
             user (str): The M365 user email.
-            encrypted_password (str): The M365 encrypted_password.
+            password (str): The M365 password.
             provider_id (str): The M365 provider ID (in this case the Tenant ID).
 
 
@@ -674,20 +674,20 @@ class M365Provider(Provider):
                 client_id,
                 client_secret,
                 user,
-                encrypted_password,
+                password,
             )
             region_config = M365Provider.setup_region_config(region)
 
             # Get the dict from the static credentials
             m365_credentials = None
             if tenant_id and client_id and client_secret:
-                if not user and not encrypted_password:
+                if not user and not password:
                     m365_credentials = M365Provider.validate_static_credentials(
                         tenant_id=tenant_id,
                         client_id=client_id,
                         client_secret=client_secret,
                         user="user",
-                        encrypted_password="encrypted_password",
+                        password="password",
                     )
                 else:
                     m365_credentials = M365Provider.validate_static_credentials(
@@ -695,7 +695,7 @@ class M365Provider(Provider):
                         client_id=client_id,
                         client_secret=client_secret,
                         user=user,
-                        encrypted_password=encrypted_password,
+                        password=password,
                     )
 
             # Set up the M365 session
@@ -733,7 +733,7 @@ class M365Provider(Provider):
                 )
 
             # Set up PowerShell credentials
-            if user and encrypted_password:
+            if user and password:
                 M365Provider.setup_powershell(
                     env_auth,
                     m365_credentials,
@@ -975,7 +975,7 @@ class M365Provider(Provider):
         client_id: str = None,
         client_secret: str = None,
         user: str = None,
-        encrypted_password: str = None,
+        password: str = None,
     ) -> dict:
         """
         Validates the static credentials for the M365 provider.
@@ -985,7 +985,7 @@ class M365Provider(Provider):
             client_id (str): The M365 client ID.
             client_secret (str): The M365 client secret.
             user (str): The M365 user email.
-            encrypted_password (str): The M365 encrypted password.
+            password (str): The M365 user password.
 
         Raises:
             M365NotValidTenantIdError: If the provided M365 Tenant ID is not valid.
@@ -1030,11 +1030,11 @@ class M365Provider(Provider):
                 message="The provided User is not valid.",
             )
 
-        # Validate the Encrypted Password
-        if not encrypted_password:
-            raise M365NotValidEncryptedPasswordError(
+        # Validate the Password
+        if not password:
+            raise M365NotValidPasswordError(
                 file=os.path.basename(__file__),
-                message="The provided Encrypted Password is not valid.",
+                message="The provided Password is not valid.",
             )
 
         try:
@@ -1044,7 +1044,7 @@ class M365Provider(Provider):
                 "client_id": client_id,
                 "client_secret": client_secret,
                 "user": user,
-                "encrypted_password": encrypted_password,
+                "password": password,
             }
         except M365NotValidTenantIdError as tenant_id_error:
             logger.error(

prowler/providers/m365/models.py

@@ -22,12 +22,13 @@ class M365RegionConfig(BaseModel):
 
 
 class M365Credentials(BaseModel):
+    user: str = ""
+    passwd: str = ""
+    encrypted_passwd: str = ""
     client_id: str = ""
     client_secret: str = ""
     tenant_id: str = ""
     tenant_domains: list[str] = []
-    user: str = ""
-    passwd: str = ""
 
 
 class M365OutputOptions(ProviderOutputOptions):

prowler/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility.py

@@ -36,7 +36,7 @@ class admincenter_groups_not_public_visibility(Check):
             report.status = "FAIL"
             report.status_extended = f"Group {group.name} has {group.visibility} visibility and should be Private."
 
-            if group.visibility != "Public":
+            if group.visibility and group.visibility != "Public":
                 report.status = "PASS"
                 report.status_extended = (
                     f"Group {group.name} has {group.visibility} visibility."

prowler/providers/m365/services/admincenter/admincenter_service.py

@@ -11,8 +11,6 @@ from prowler.providers.m365.m365_provider import M365Provider
 class AdminCenter(M365Service):
     def __init__(self, provider: M365Provider):
         super().__init__(provider)
-        if self.powershell:
-            self.powershell.close()
 
         self.organization_config = None
         self.sharing_policy = None
@@ -203,7 +201,7 @@ class DirectoryRole(BaseModel):
 class Group(BaseModel):
     id: str
     name: str
-    visibility: str
+    visibility: Optional[str]
 
 
 class Domain(BaseModel):

prowler/providers/m365/services/entra/entra_identity_protection_sign_in_risk_enabled/entra_identity_protection_sign_in_risk_enabled.py

@@ -9,13 +9,13 @@ from prowler.providers.m365.services.entra.entra_service import (
 
 
 class entra_identity_protection_sign_in_risk_enabled(Check):
-    """Check if at least one Conditional Access policy is a Identity Protection sign-in risk policy.
+    """Check if at least one Conditional Access policy is an Identity Protection sign-in risk policy.
 
-    This check ensures that at least one Conditional Access policy is a Identity Protection sign-in risk policy.
+    This check ensures that at least one Conditional Access policy is an Identity Protection sign-in risk policy.
     """
 
     def execute(self) -> list[CheckReportM365]:
-        """Execute the check to ensure that at least one Conditional Access policy is a Identity Protection sign-in risk policy.
+        """Execute the check to ensure that at least one Conditional Access policy is an Identity Protection sign-in risk policy.
 
         Returns:
             list[CheckReportM365]: A list containing the results of the check.

prowler/providers/m365/services/entra/entra_identity_protection_user_risk_enabled/entra_identity_protection_user_risk_enabled.py

@@ -9,13 +9,13 @@ from prowler.providers.m365.services.entra.entra_service import (
 
 
 class entra_identity_protection_user_risk_enabled(Check):
-    """Check if at least one Conditional Access policy is a Identity Protection user risk policy.
+    """Check if at least one Conditional Access policy is an Identity Protection user risk policy.
 
-    This check ensures that at least one Conditional Access policy is a Identity Protection user risk policy.
+    This check ensures that at least one Conditional Access policy is an Identity Protection user risk policy.
     """
 
     def execute(self) -> list[CheckReportM365]:
-        """Execute the check to ensure that at least one Conditional Access policy is a Identity Protection user risk policy.
+        """Execute the check to ensure that at least one Conditional Access policy is an Identity Protection user risk policy.
 
         Returns:
             list[CheckReportM365]: A list containing the results of the check.
@@ -29,7 +29,7 @@ class entra_identity_protection_user_risk_enabled(Check):
             resource_id="conditionalAccessPolicies",
         )
         report.status = "FAIL"
-        report.status_extended = "No Conditional Access Policy is an user risk based Identity Protection Policy."
+        report.status_extended = "No Conditional Access Policy is a user risk based Identity Protection Policy."
 
         for policy in entra_client.conditional_access_policies.values():
             if policy.state == ConditionalAccessPolicyState.DISABLED:
@@ -62,13 +62,13 @@ class entra_identity_protection_user_risk_enabled(Check):
                 )
                 if RiskLevel.HIGH not in policy.conditions.user_risk_levels:
                     report.status = "FAIL"
-                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is an user risk based Identity Protection Policy but does not protect against high risk potential account compromises."
+                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is a user risk based Identity Protection Policy but does not protect against high risk potential account compromises."
                 elif policy.state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING:
                     report.status = "FAIL"
-                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is an user risk based Identity Protection Policy and reports high risk potential account compromises, but does not protect against them."
+                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is a user risk based Identity Protection Policy and reports high risk potential account compromises, but does not protect against them."
                 else:
                     report.status = "PASS"
-                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is an user risk based Identity Protection Policy and does protect against high risk potential account compromises."
+                    report.status_extended = f"Conditional Access Policy '{policy.display_name}' is a user risk based Identity Protection Policy and does protect against high risk potential account compromises."
                     break
 
         findings.append(report)

prowler/providers/m365/services/entra/entra_service.py

@@ -493,6 +493,7 @@ class ConditionalAccessGrantControl(Enum):
     BLOCK = "block"
     DOMAIN_JOINED_DEVICE = "domainJoinedDevice"
     PASSWORD_CHANGE = "passwordChange"
+    COMPLIANT_DEVICE = "compliantDevice"
 
 
 class GrantControlOperator(Enum):

prowler/providers/nhn/services/compute/compute_instance_login_user/compute_instance_login_user.py

@@ -12,7 +12,7 @@ class compute_instance_login_user(Check):
             )
             report.status = "PASS"
             report.status_extended = (
-                f"VM Instance {instance.name} has a appropriate login user."
+                f"VM Instance {instance.name} has an appropriate login user."
             )
             if instance.login_user:
                 report.status = "FAIL"

tests/lib/check/models_test.py

@@ -37,7 +37,7 @@ mock_metadata_lambda = CheckMetadata(
     CheckID="awslambda_function_url_public",
     CheckTitle="Check 1",
     CheckType=["type1"],
-    ServiceName="lambda",
+    ServiceName="awslambda",
     SubServiceName="subservice1",
     ResourceIdTemplate="template1",
     Severity="high",

tests/lib/outputs/compliance/fixtures.py

@@ -857,7 +857,6 @@ KISA_ISMSP_AWS = Compliance(
     ],
 )
 
-PROWLER_THREATSCORE_AWS_NAME = "prowler_threatscore_aws"
 PROWLER_THREATSCORE_AWS = Compliance(
     Framework="ProwlerThreatScore",
     Version="1.0",
@@ -901,7 +900,6 @@ PROWLER_THREATSCORE_AWS = Compliance(
     ],
 )
 
-PROWLER_THREATSCORE_AZURE_NAME = "prowler_threatscore_azure"
 PROWLER_THREATSCORE_AZURE = Compliance(
     Framework="ProwlerThreatScore",
     Version="1.0",
@@ -945,7 +943,6 @@ PROWLER_THREATSCORE_AZURE = Compliance(
     ],
 )
 
-PROWLER_THREATSCORE_GCP_NAME = "prowler_threatscore_gcp"
 PROWLER_THREATSCORE_GCP = Compliance(
     Framework="ProwlerThreatScore",
     Version="1.0",
@@ -989,7 +986,6 @@ PROWLER_THREATSCORE_GCP = Compliance(
     ],
 )
 
-PROWLER_THREATSCORE_M365_NAME = "prowler_threatscore_m365"
 PROWLER_THREATSCORE_M365 = Compliance(
     Framework="ProwlerThreatScore",
     Version="1.0",