Hugo P.Brito
62ad4e5b9f
docs(m365): move PIM stale alert changelog entry to 5.27.0
...
The PIM stale sign-in alert check entry was placed under the already
released 5.24.1 section. Move it to a new [5.27.0] (UNRELEASED) block at
the top of the changelog so the entry lands in the actual shipping
release notes.
2026-05-11 12:01:09 +01:00
Hugo P.Brito
ce8f6037c1
fix(m365): drop misleading fallbacks when parsing PIM alert incidents
...
The DirectoryRoleStaleSignInAlertIncident schema does not expose 'subject',
'createdDateTime', or any field whose 'id' represents the affected user, so
the previous fallbacks silently substituted the wrong values and made
status_extended messages refer to the incident GUID instead of the actual
user when the API response omitted assigneeId/assigneeDisplayName.
Read each field directly from the documented incident properties so an
empty value stays empty rather than being papered over with unrelated
data.
2026-05-11 12:00:08 +01:00
Hugo P.Brito
b49e49f543
fix(m365): require active PIM stale alert before flagging accounts
...
The PIM alert object exposes an is_active flag that goes False once the
alert condition stops firing, even though the previous number_of_affected_items
count can stick around in the API response. The check was ignoring that
flag, so a tenant whose alert was already resolved or dismissed could
still receive a FAIL based on stale counters.
Gate the FAIL branch on alert.is_active so only currently-firing alerts
produce findings; everything else (resolved alert, inactive with leftover
counts) is reported as PASS. A regression test covers the inactive-with-
counts case to lock the behavior in.
2026-05-11 11:48:46 +01:00
Hugo P.Brito
4cf2207d58
fix(m365): emit a single MANUAL finding when PIM stale alert is unavailable
...
The previous behavior fanned out a FAIL finding for every Organization the
tenant returned whenever the stale sign-in alert was missing from the API
response. That conflates three distinct conditions — no Microsoft Entra ID
P2 license, alert disabled, or insufficient permission — into the same
verdict, penalizes tenants without PIM, and emits N near-duplicate findings
for what is logically a single tenant-level state.
Emit a single MANUAL finding pinned to the first organization instead, with
a status_extended that lists the actionable causes so the operator can
choose what to remediate. MANUAL is the right verdict because the cause may
be legitimate (no P2) rather than misconfiguration.
2026-05-11 11:43:42 +01:00
Hugo P.Brito
080bc174fa
fix(m365): drop external test-suite reference from PIM stale alert metadata
...
Remove the third-party documentation URL so the public metadata only
points to Microsoft's official PIM alert guidance.
2026-05-11 11:41:51 +01:00
Hugo P.Brito
6fac51047c
Merge remote-tracking branch 'origin/master' into feat/prowler-846
2026-05-11 11:34:17 +01:00
Alejandro Bailo and Pepe Fagoaga
4b71f37c91
docs(docs): add alerts guide ( #11101 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-05-11 12:23:54 +02:00
Hugo Pereira Brito
cdfbe5b2e3
fix(ui): label finding drawer column as Provider, not Account ( #11102 )
2026-05-11 12:03:03 +02:00
Hugo Pereira Brito
1b6a459df4
refactor(ui): reorganize finding detail drawer ( #11091 )
2026-05-11 09:47:43 +01:00
Daniel Barranquero
73c0305dc4
feat(aws): add bedrock_prompt_encrypted_with_cmk security check ( #10905 )
2026-05-11 10:32:44 +02:00
Pedro Martín and alejandrobailo
0e01e67257
feat(ui): ASD Essential Eight compliance framework support ( #11071 )
...
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com >
2026-05-11 09:55:04 +02:00
1ad329f9cf
feat(ui): ThreatScore compliance views pillars, nav + charts ( #10975 )
...
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com >
Co-authored-by: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com >
2026-05-11 09:53:55 +02:00
Pedro Martín
d03d1d2393
chore(changelog): update for universal compliance ( #11100 )
2026-05-11 09:50:32 +02:00
Davidm4r
832516be2a
fix(mcp_server): bump transitive requests to 2.33.1 (advisory 90553) ( #11084 )
2026-05-08 12:52:46 +02:00
Prowler Bot and prowler-bot
34727a7237
chore(docs): Bump version to v5.25.3 ( #11080 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-05-08 10:40:41 +02:00
Alejandro Bailo
4216a3e23a
feat(ui): add cloud-gated custom alerts ( #11003 )
2026-05-08 10:36:43 +02:00
Pepe Fagoaga
a59192e6f5
chore: changelog v5.25.3 ( #11077 )
2026-05-08 08:37:06 +02:00
Pepe Fagoaga
592bc6f6a8
chore: enable sponsor for prowler-cloud ( #11076 )
2026-05-08 08:25:28 +02:00
lydiavilchez
962ebac8e4
feat(googleworkspace): add Gmail consequence-based checks for attachment safety and spoofing ( #10980 )
2026-05-07 16:50:36 +02:00
Hugo Pereira Brito and Hugo P.Brito
2c5d47a8cd
chore: route vulnerability references to canonical URLs ( #10853 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-07 15:28:50 +01:00
bcaa6ac488
fix(sdk): scan every Azure subscription when display names collide ( #10718 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-07 13:59:38 +02:00
Rubén De la Torre Vico
71683f3093
chore: remove pre-push from default install hook types ( #11072 )
2026-05-07 11:19:40 +02:00
Hugo Pereira Brito
2357af912d
fix(ui): hide line numbers in CLI command remediation block ( #11059 )
2026-05-06 14:04:49 +01:00
Pedro Martín and César Arroba
7971b40f49
feat(api): ASD Essential Eight compliance framework support ( #10982 )
...
Co-authored-by: César Arroba <cesar@prowler.com >
2026-05-06 14:03:00 +02:00
Pedro Martín and César Arroba
e585ae45bd
feat(aws): rename Essential Eight to ASD Essential Eight ( #11054 )
...
Co-authored-by: César Arroba <cesar@prowler.com >
2026-05-06 13:11:29 +02:00
Hugo Pereira Brito
4d9921a9b7
fix: PR number in changelog entry for #10529 ( #11057 )
2026-05-06 11:53:31 +01:00
19b602c381
fix(oci): scan identity in known valid region ( #10529 )
...
Co-authored-by: Ronan Chota <ronan.chota@saic.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
2026-05-06 11:19:19 +01:00
Pedro Martín and César Arroba
4c3e741af7
chore(pyproject): revert API changes ( #11049 )
...
Co-authored-by: César Arroba <cesar@prowler.com >
2026-05-06 12:09:46 +02:00
César Arroba
8affbf44ce
revert(ci): drop workflow-level paths on required-check workflows ( #11055 )
2026-05-06 11:49:42 +02:00
César Arroba
16798e293d
ci(pr-conflict-checker): restore persist-credentials so base ref fetch works on private mirrors ( #11019 )
2026-05-06 00:33:40 +02:00
César Arroba
1194d34396
ci(ui-e2e): reduce Playwright artifact retention to 7 days ( #11018 )
2026-05-06 00:09:34 +02:00
César Arroba
98277689f5
ci: reduce GitHub Actions consumption across CI workflows ( #11007 )
2026-05-05 17:08:34 +02:00
0ddd7fbd69
docs(aws): add guide for extending existing services ( #10924 )
...
Co-authored-by: Mohamed Solaiman <mohamedsolaiman@users.noreply.github.com >
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com >
2026-05-05 16:51:58 +02:00
Pedro Martín
22b233f206
chore(deps): bump requests to 2.33.1 to fix CVE-2026-25645 ( #10983 )
2026-05-05 16:43:18 +02:00
Daniel Barranquero
aa759ab6b7
fix(attack-surface): restore ec2-imdsv1 category alignment ( #10998 )
2026-05-05 16:42:47 +02:00
Hugo Pereira Brito and Pepe Fagoaga
369d6cecc1
fix: patch CVE-2026-39892 and CVE-2026-33186 across SDK, API and MCP images ( #10978 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-05-05 15:04:44 +01:00
d23c2f3b53
refactor(ui): standardize "Providers" wording across UI and docs ( #10971 )
...
Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-05 14:39:54 +02:00
Prowler Bot and prowler-bot
786059bfb2
chore(docs): Bump version to v5.25.2 ( #10993 )
...
Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com >
2026-05-05 10:45:07 +02:00
Pepe Fagoaga
703a33108c
chore(changelog): prepare for v5.25.2 ( #10991 )
2026-05-05 08:47:28 +02:00
Pepe Fagoaga and Andoni A.
7c6d658154
fix(k8s): match RBAC rules by apiGroup, not just core ( #10969 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-05-04 19:54:03 +02:00
Pepe Fagoaga
21d7d08b4b
fix(timeline): Return a compact actor name from CloudTrail events ( #10986 )
2026-05-04 19:39:17 +02:00
Pepe Fagoaga and Andoni A.
f314725f4d
fix(k8s): deduplicate RBAC findings by unique subject ( #10242 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-05-04 18:11:38 +02:00
Rubén De la Torre Vico
02f43a7ad6
docs: add Prowler Studio page and remove check-kreator pages ( #10981 )
2026-05-04 17:51:02 +02:00
Daniel Barranquero
0dd8981ee4
feat: add issue template for creating new checks ( #10976 )
2026-05-04 17:47:39 +02:00
Rubén De la Torre Vico
269e51259d
docs: add troubleshooting guide for stuck scans after worker crash ( #10938 )
2026-05-04 17:24:09 +02:00
Hugo Pereira Brito
f4afdf0541
chore(ui): decrement changelog entry version to 1.25.2 ( #10974 )
2026-05-04 14:59:27 +01:00
Hugo Pereira Brito
652cb69216
fix(ui): compliance card layout polish ( #10939 )
2026-05-04 12:59:06 +01:00
Daniel Barranquero
921f49a0de
feat(aws): add bedrock_prompt_management_exists security check ( #10878 )
2026-05-04 12:38:15 +02:00
Hugo Pereira Brito
6cb770fcc8
fix(ui): clean up findings expanded resource row layout ( #10949 )
2026-05-04 11:17:54 +01:00
Daniel Barranquero
86449fb99d
chore(vercel): add disclaimer for checks depending on billing plan ( #10663 )
2026-05-04 08:56:50 +02:00
Hugo P.Brito