Merge branch 'master' into PRWLR-7512-create-custom-link-component

Co-authored-by: Víctor Fernández Poyatos <victor@prowler.com>

.env

@@ -6,6 +6,7 @@
 PROWLER_UI_VERSION="stable"
 AUTH_URL=http://localhost:3000
 API_BASE_URL=http://prowler-api:8080/api/v1
+NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL}
 NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
 AUTH_TRUST_HOST=true
 UI_PORT=3000
@@ -130,7 +131,7 @@ SENTRY_ENVIRONMENT=local
 SENTRY_RELEASE=local
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.6.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.7.5
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -142,8 +143,7 @@ SOCIAL_GITHUB_OAUTH_CLIENT_ID=""
 SOCIAL_GITHUB_OAUTH_CLIENT_SECRET=""
 
 # Single Sign-On (SSO)
-SAML_PUBLIC_CERT=""
-SAML_PRIVATE_KEY=""
+SAML_SSO_CALLBACK_URL="${AUTH_URL}/api/auth/callback/saml"
 
 # Lighthouse tracing
 LANGSMITH_TRACING=false

.github/workflows/api-build-lint-push-containers.yml

@@ -76,7 +76,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build and push container image (latest)
         # Comment the following line for testing

.github/workflows/api-codeql.yml

@@ -48,12 +48,12 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/api-codeql-config.yml
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/api-pull-request.yml

@@ -169,9 +169,9 @@ jobs:
       - name: Safety
         working-directory: ./api
         if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
-        # 76352 and 76353 come from SDK, but they cannot upgrade it yet. It does not affect API
+        # 76352, 76353, 77323 come from SDK, but they cannot upgrade it yet. It does not affect API
         run: |
-          poetry run safety check --ignore 70612,66963,74429,76352,76353
+          poetry run safety check --ignore 70612,66963,74429,76352,76353,77323
 
       - name: Vulture
         working-directory: ./api
@@ -211,7 +211,7 @@ jobs:
           files_ignore: ${{ env.IGNORE_FILES }}
       - name: Set up Docker Buildx
         if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Build Container
         if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true'
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0

.github/workflows/find-secrets.yml

@@ -11,7 +11,7 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@90694bf9af66e7536abc5824e7a87246dbf933cb # v3.88.35
+        uses: trufflesecurity/trufflehog@6641d4ba5b684fffe195b9820345de1bf19f3181 # v3.89.2
         with:
           path: ./
           base: ${{ github.event.repository.default_branch }}

.github/workflows/sdk-build-lint-push-containers.yml

@@ -123,7 +123,7 @@ jobs:
           AWS_REGION: ${{ env.AWS_REGION }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build and push container image (latest)
         if: github.event_name == 'push'

.github/workflows/sdk-codeql.yml

@@ -56,12 +56,12 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/sdk-codeql-config.yml
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+      uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/ui-build-lint-push-containers.yml

@@ -30,6 +30,7 @@ env:
   # Container Registries
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-ui
+  NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
 
 jobs:
   repository-check:
@@ -76,7 +77,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
       - name: Build and push container image (latest)
         # Comment the following line for testing
@@ -86,6 +87,7 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ env.SHORT_SHA }}
+            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           # Set push: false for testing
           push: true
           tags: |
@@ -101,6 +103,7 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v${{ env.RELEASE_TAG }}
+            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           push: true
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.RELEASE_TAG }}

.github/workflows/ui-codeql.yml

@@ -48,12 +48,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/ui-codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
+        uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/ui-pull-request.yml

@@ -34,21 +34,70 @@ jobs:
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: './ui/package-lock.json'
       - name: Install dependencies
         working-directory: ./ui
-        run: npm install
+        run: npm ci
       - name: Run Healthcheck
         working-directory: ./ui
         run: npm run healthcheck
       - name: Build the application
         working-directory: ./ui
         run: npm run build
+
+  e2e-tests:
+    runs-on: ubuntu-latest
+    env:
+      AUTH_SECRET: 'fallback-ci-secret-for-testing'
+      AUTH_TRUST_HOST: true
+      NEXTAUTH_URL: http://localhost:3000
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+          cache-dependency-path: './ui/package-lock.json'
+      - name: Install dependencies
+        working-directory: ./ui
+        run: npm ci
+      - name: Cache Playwright browsers
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('ui/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+      - name: Install Playwright browsers
+        working-directory: ./ui
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npm run test:e2e:install
+      - name: Build the application
+        working-directory: ./ui
+        run: npm run build
+      - name: Run Playwright tests
+        working-directory: ./ui
+        run: npm run test:e2e
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        if: failure()
+        with:
+          name: playwright-report
+          path: ui/playwright-report/
+          retention-days: 30
+
   test-container-build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Build Container
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         with:

.gitignore

@@ -44,6 +44,16 @@ junit-reports/
 
 # Cursor files
 .cursorignore
+.cursor/
+
+# RooCode files
+.roo/
+.rooignore
+.roomodes
+
+# Cline files
+.cline/
+.clineignore
 
 # Terraform
 .terraform*

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12.10-slim-bookworm AS build
+FROM python:3.12.11-slim-bookworm AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
@@ -6,7 +6,8 @@ LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 ARG POWERSHELL_VERSION=7.5.0
 
 # hadolint ignore=DL3008
-RUN apt-get update && apt-get install -y --no-install-recommends wget libicu72 \
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    wget libicu72 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -46,10 +47,6 @@ ENV PATH="${HOME}/.local/bin:${PATH}"
 RUN pip install --no-cache-dir --upgrade pip && \
     pip install --no-cache-dir poetry
 
-# By default poetry does not compile Python source files to bytecode during installation.
-# This speeds up the installation process, but the first execution may take a little more
-# time because Python then compiles source files to bytecode automatically. If you want to
-# compile source files to bytecode during installation, you can use the --compile option
 RUN poetry install --compile && \
     rm -rf ~/.cache/pip
 

api/CHANGELOG.md

@@ -2,16 +2,33 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-## [v1.9.0] (Prowler UNRELEASED)
+## [v1.10.0] (Prowler UNRELEASED)
+
+### Added
+- SSO with SAML support [(#8175)](https://github.com/prowler-cloud/prowler/pull/8175)
+
+---
+
+## [v1.9.1] (Prowler v5.8.1)
+
+### Fixed
+- Scan with no resources will not trigger legacy code for findings metadata [(#8183)](https://github.com/prowler-cloud/prowler/pull/8183)
+
+### Removed
+- Validation of the provider's secret type during updates [(#8197)](https://github.com/prowler-cloud/prowler/pull/8197)
+
+---
+
+## [v1.9.0] (Prowler v5.8.0)
 
 ### Added
-- SSO with SAML support [(#7822)](https://github.com/prowler-cloud/prowler/pull/7822)
 - Support GCP Service Account key [(#7824)](https://github.com/prowler-cloud/prowler/pull/7824)
 - `GET /compliance-overviews` endpoints to retrieve compliance metadata and specific requirements statuses [(#7877)](https://github.com/prowler-cloud/prowler/pull/7877)
 - Lighthouse configuration support [(#7848)](https://github.com/prowler-cloud/prowler/pull/7848)
 
 ### Changed
 - Reworked `GET /compliance-overviews` to return proper requirement metrics [(#7877)](https://github.com/prowler-cloud/prowler/pull/7877)
+- Optional `user` and `password` for M365 provider [(#7992)](https://github.com/prowler-cloud/prowler/pull/7992)
 
 ### Fixed
 - Scheduled scans are no longer deleted when their daily schedule run is disabled [(#8082)](https://github.com/prowler-cloud/prowler/pull/8082)

api/poetry.lock

@@ -1,4 +1,4 @@
-# This file is automatically @generated by Poetry 2.1.1 and should not be changed by hand.
+# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand.
 
 [[package]]
 name = "about-time"
@@ -880,7 +880,6 @@ description = "Foreign Function Interface for Python calling C code."
 optional = false
 python-versions = ">=3.8"
 groups = ["main", "dev"]
-markers = "platform_python_implementation != \"PyPy\""
 files = [
     {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"},
     {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"},
@@ -950,6 +949,7 @@ files = [
     {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"},
     {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"},
 ]
+markers = {dev = "platform_python_implementation != \"PyPy\""}
 
 [package.dependencies]
 pycparser = "*"
@@ -3854,26 +3854,26 @@ testing = ["google-api-core (>=1.31.5)"]
 
 [[package]]
 name = "protobuf"
-version = "6.30.2"
+version = "6.31.1"
 description = ""
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "protobuf-6.30.2-cp310-abi3-win32.whl", hash = "sha256:b12ef7df7b9329886e66404bef5e9ce6a26b54069d7f7436a0853ccdeb91c103"},
-    {file = "protobuf-6.30.2-cp310-abi3-win_amd64.whl", hash = "sha256:7653c99774f73fe6b9301b87da52af0e69783a2e371e8b599b3e9cb4da4b12b9"},
-    {file = "protobuf-6.30.2-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:0eb523c550a66a09a0c20f86dd554afbf4d32b02af34ae53d93268c1f73bc65b"},
-    {file = "protobuf-6.30.2-cp39-abi3-manylinux2014_aarch64.whl", hash = "sha256:50f32cc9fd9cb09c783ebc275611b4f19dfdfb68d1ee55d2f0c7fa040df96815"},
-    {file = "protobuf-6.30.2-cp39-abi3-manylinux2014_x86_64.whl", hash = "sha256:4f6c687ae8efae6cf6093389a596548214467778146b7245e886f35e1485315d"},
-    {file = "protobuf-6.30.2-cp39-cp39-win32.whl", hash = "sha256:524afedc03b31b15586ca7f64d877a98b184f007180ce25183d1a5cb230ee72b"},
-    {file = "protobuf-6.30.2-cp39-cp39-win_amd64.whl", hash = "sha256:acec579c39c88bd8fbbacab1b8052c793efe83a0a5bd99db4a31423a25c0a0e2"},
-    {file = "protobuf-6.30.2-py3-none-any.whl", hash = "sha256:ae86b030e69a98e08c77beab574cbcb9fff6d031d57209f574a5aea1445f4b51"},
-    {file = "protobuf-6.30.2.tar.gz", hash = "sha256:35c859ae076d8c56054c25b59e5e59638d86545ed6e2b6efac6be0b6ea3ba048"},
+    {file = "protobuf-6.31.1-cp310-abi3-win32.whl", hash = "sha256:7fa17d5a29c2e04b7d90e5e32388b8bfd0e7107cd8e616feef7ed3fa6bdab5c9"},
+    {file = "protobuf-6.31.1-cp310-abi3-win_amd64.whl", hash = "sha256:426f59d2964864a1a366254fa703b8632dcec0790d8862d30034d8245e1cd447"},
+    {file = "protobuf-6.31.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:6f1227473dc43d44ed644425268eb7c2e488ae245d51c6866d19fe158e207402"},
+    {file = "protobuf-6.31.1-cp39-abi3-manylinux2014_aarch64.whl", hash = "sha256:a40fc12b84c154884d7d4c4ebd675d5b3b5283e155f324049ae396b95ddebc39"},
+    {file = "protobuf-6.31.1-cp39-abi3-manylinux2014_x86_64.whl", hash = "sha256:4ee898bf66f7a8b0bd21bce523814e6fbd8c6add948045ce958b73af7e8878c6"},
+    {file = "protobuf-6.31.1-cp39-cp39-win32.whl", hash = "sha256:0414e3aa5a5f3ff423828e1e6a6e907d6c65c1d5b7e6e975793d5590bdeecc16"},
+    {file = "protobuf-6.31.1-cp39-cp39-win_amd64.whl", hash = "sha256:8764cf4587791e7564051b35524b72844f845ad0bb011704c3736cce762d8fe9"},
+    {file = "protobuf-6.31.1-py3-none-any.whl", hash = "sha256:720a6c7e6b77288b85063569baae8536671b39f15cc22037ec7045658d80489e"},
+    {file = "protobuf-6.31.1.tar.gz", hash = "sha256:d8cac4c982f0b957a4dc73a80e2ea24fab08e679c0de9deb835f4a12d69aca9a"},
 ]
 
 [[package]]
 name = "prowler"
-version = "5.6.0"
+version = "5.8.0"
 description = "Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technical Review (FTR), ENS (Spanish National Security Scheme) and your custom security frameworks."
 optional = false
 python-versions = ">3.9.1,<3.13"
@@ -3921,6 +3921,7 @@ numpy = "2.0.2"
 pandas = "2.2.3"
 py-ocsf-models = "0.3.1"
 pydantic = "1.10.21"
+pygithub = "2.5.0"
 python-dateutil = ">=2.9.0.post0,<3.0.0"
 pytz = "2025.1"
 schema = "0.7.7"
@@ -3933,7 +3934,7 @@ tzlocal = "5.3.1"
 type = "git"
 url = "https://github.com/prowler-cloud/prowler.git"
 reference = "master"
-resolved_reference = "9828824b737b8deda61f4a6646b54e0ad45033b9"
+resolved_reference = "ea97de7f43a2063476b49f7697bb6c7b51137c11"
 
 [[package]]
 name = "psutil"
@@ -4110,11 +4111,11 @@ description = "C parser in Python"
 optional = false
 python-versions = ">=3.8"
 groups = ["main", "dev"]
-markers = "platform_python_implementation != \"PyPy\""
 files = [
     {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"},
     {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"},
 ]
+markers = {dev = "platform_python_implementation != \"PyPy\""}
 
 [[package]]
 name = "pycurl"
@@ -4225,6 +4226,26 @@ typing-extensions = ">=4.2.0"
 dotenv = ["python-dotenv (>=0.10.4)"]
 email = ["email-validator (>=1.0.3)"]
 
+[[package]]
+name = "pygithub"
+version = "2.5.0"
+description = "Use the full Github API v3"
+optional = false
+python-versions = ">=3.8"
+groups = ["main"]
+files = [
+    {file = "PyGithub-2.5.0-py3-none-any.whl", hash = "sha256:b0b635999a658ab8e08720bdd3318893ff20e2275f6446fcf35bf3f44f2c0fd2"},
+    {file = "pygithub-2.5.0.tar.gz", hash = "sha256:e1613ac508a9be710920d26eb18b1905ebd9926aa49398e88151c1b526aad3cf"},
+]
+
+[package.dependencies]
+Deprecated = "*"
+pyjwt = {version = ">=2.4.0", extras = ["crypto"]}
+pynacl = ">=1.4.0"
+requests = ">=2.14.0"
+typing-extensions = ">=4.0.0"
+urllib3 = ">=1.26.0"
+
 [[package]]
 name = "pygments"
 version = "2.19.1"
@@ -4289,6 +4310,33 @@ tomlkit = ">=0.10.1"
 spelling = ["pyenchant (>=3.2,<4.0)"]
 testutils = ["gitpython (>3)"]
 
+[[package]]
+name = "pynacl"
+version = "1.5.0"
+description = "Python binding to the Networking and Cryptography (NaCl) library"
+optional = false
+python-versions = ">=3.6"
+groups = ["main"]
+files = [
+    {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"},
+    {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"},
+    {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"},
+]
+
+[package.dependencies]
+cffi = ">=1.4.1"
+
+[package.extras]
+docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"]
+tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"]
+
 [[package]]
 name = "pyparsing"
 version = "3.2.3"

api/src/backend/api/adapters.py

@@ -3,14 +3,7 @@ from django.db import transaction
 
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
-from api.models import (
-    Membership,
-    Role,
-    SAMLConfiguration,
-    Tenant,
-    User,
-    UserRoleRelationship,
-)
+from api.models import Membership, Role, Tenant, User, UserRoleRelationship
 
 
 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
@@ -24,7 +17,7 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
     def pre_social_login(self, request, sociallogin):
         # Link existing accounts with the same email address
         email = sociallogin.account.extra_data.get("email")
-        if sociallogin.account.provider == "saml":
+        if sociallogin.provider.id == "saml":
             email = sociallogin.user.email
         if email:
             existing_user = self.get_user_by_email(email)
@@ -38,71 +31,10 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         """
         with transaction.atomic(using=MainRouter.admin_db):
             user = super().save_user(request, sociallogin, form)
-            provider = sociallogin.account.provider
+            provider = sociallogin.provider.id
             extra = sociallogin.account.extra_data
 
-            if provider == "saml":
-                # Handle SAML-specific logic
-                user.first_name = (
-                    extra.get("firstName", [""])[0] if extra.get("firstName") else ""
-                )
-                user.last_name = (
-                    extra.get("lastName", [""])[0] if extra.get("lastName") else ""
-                )
-                user.company_name = (
-                    extra.get("organization", [""])[0]
-                    if extra.get("organization")
-                    else ""
-                )
-                user.name = f"{user.first_name} {user.last_name}".strip()
-                if user.name == "":
-                    user.name = "N/A"
-                user.save(using=MainRouter.admin_db)
-
-                email_domain = user.email.split("@")[-1]
-                tenant = (
-                    SAMLConfiguration.objects.using(MainRouter.admin_db)
-                    .get(email_domain=email_domain)
-                    .tenant
-                )
-
-                with rls_transaction(str(tenant.id)):
-                    role_name = (
-                        extra.get("userType", ["saml_default_role"])[0].strip()
-                        if extra.get("userType")
-                        else "saml_default_role"
-                    )
-
-                    try:
-                        role = Role.objects.using(MainRouter.admin_db).get(
-                            name=role_name, tenant_id=tenant.id
-                        )
-                    except Role.DoesNotExist:
-                        role = Role.objects.using(MainRouter.admin_db).create(
-                            name=role_name,
-                            tenant_id=tenant.id,
-                            manage_users=False,
-                            manage_account=False,
-                            manage_billing=False,
-                            manage_providers=False,
-                            manage_integrations=False,
-                            manage_scans=False,
-                            unlimited_visibility=False,
-                        )
-
-                    Membership.objects.using(MainRouter.admin_db).create(
-                        user=user,
-                        tenant=tenant,
-                        role=Membership.RoleChoices.MEMBER,
-                    )
-
-                    UserRoleRelationship.objects.using(MainRouter.admin_db).create(
-                        user=user,
-                        role=role,
-                        tenant_id=tenant.id,
-                    )
-
-            else:
+            if provider != "saml":
                 # Handle other providers (e.g., GitHub, Google)
                 user.save(using=MainRouter.admin_db)
                 social_account_name = extra.get("name")

api/src/backend/api/migrations/0030_lighthouseconfiguration.py

@@ -11,7 +11,7 @@ import api.rls
 
 class Migration(migrations.Migration):
     dependencies = [
-        ("api", "0030_samlconfigurations"),
+        ("api", "0029_findings_check_index_parent"),
     ]
 
     operations = [

api/src/backend/api/migrations/0031_scan_disable_on_cascade_periodic_tasks.py

@@ -6,7 +6,7 @@ from django.db import migrations, models
 
 class Migration(migrations.Migration):
     dependencies = [
-        ("api", "0031_lighthouseconfiguration"),
+        ("api", "0030_lighthouseconfiguration"),
         ("django_celery_beat", "0019_alter_periodictasks_options"),
     ]
 

api/src/backend/api/migrations/0032_saml.py

@@ -1,57 +1,61 @@
-# Generated by Django 5.1.8 on 2025-05-15 09:54
+# Generated by Django 5.1.10 on 2025-07-02 15:47
 
 import uuid
 
 import django.db.models.deletion
+from django.conf import settings
 from django.db import migrations, models
 
+import api.db_utils
 import api.rls
 
 
 class Migration(migrations.Migration):
     dependencies = [
-        ("api", "0029_findings_check_index_parent"),
+        ("api", "0031_scan_disable_on_cascade_periodic_tasks"),
     ]
 
     operations = [
+        migrations.AlterField(
+            model_name="integration",
+            name="integration_type",
+            field=api.db_utils.IntegrationTypeEnumField(
+                choices=[
+                    ("amazon_s3", "Amazon S3"),
+                    ("aws_security_hub", "AWS Security Hub"),
+                    ("jira", "JIRA"),
+                    ("slack", "Slack"),
+                ]
+            ),
+        ),
         migrations.CreateModel(
-            name="SAMLDomainIndex",
+            name="SAMLToken",
             fields=[
                 (
                     "id",
-                    models.BigAutoField(
-                        auto_created=True,
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
                         primary_key=True,
                         serialize=False,
-                        verbose_name="ID",
                     ),
                 ),
-                ("email_domain", models.CharField(max_length=254, unique=True)),
+                ("inserted_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("expires_at", models.DateTimeField(editable=False)),
+                ("token", models.JSONField(unique=True)),
                 (
-                    "tenant",
+                    "user",
                     models.ForeignKey(
-                        on_delete=django.db.models.deletion.CASCADE, to="api.tenant"
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to=settings.AUTH_USER_MODEL,
                     ),
                 ),
             ],
             options={
-                "db_table": "saml_domain_index",
+                "db_table": "saml_tokens",
             },
         ),
-        migrations.AddConstraint(
-            model_name="samldomainindex",
-            constraint=models.UniqueConstraint(
-                fields=("email_domain", "tenant"),
-                name="unique_resources_by_email_domain",
-            ),
-        ),
-        migrations.AddConstraint(
-            model_name="samldomainindex",
-            constraint=api.rls.BaseSecurityConstraint(
-                name="statements_on_samldomainindex",
-                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
-            ),
-        ),
         migrations.CreateModel(
             name="SAMLConfiguration",
             fields=[
@@ -105,16 +109,42 @@ class Migration(migrations.Migration):
                 fields=("tenant",), name="unique_samlconfig_per_tenant"
             ),
         ),
-        migrations.AlterField(
-            model_name="integration",
-            name="integration_type",
-            field=api.db_utils.IntegrationTypeEnumField(
-                choices=[
-                    ("amazon_s3", "Amazon S3"),
-                    ("aws_security_hub", "AWS Security Hub"),
-                    ("jira", "JIRA"),
-                    ("slack", "Slack"),
-                ]
+        migrations.CreateModel(
+            name="SAMLDomainIndex",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True,
+                        primary_key=True,
+                        serialize=False,
+                        verbose_name="ID",
+                    ),
+                ),
+                ("email_domain", models.CharField(max_length=254, unique=True)),
+                (
+                    "tenant",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, to="api.tenant"
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "saml_domain_index",
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="samldomainindex",
+            constraint=models.UniqueConstraint(
+                fields=("email_domain", "tenant"),
+                name="unique_resources_by_email_domain",
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="samldomainindex",
+            constraint=api.rls.BaseSecurityConstraint(
+                name="statements_on_samldomainindex",
+                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
             ),
         ),
     ]

api/src/backend/api/models.py

@@ -2,6 +2,7 @@ import json
 import logging
 import re
 import xml.etree.ElementTree as ET
+from datetime import datetime, timedelta, timezone
 from uuid import UUID, uuid4
 
 from allauth.socialaccount.models import SocialApp
@@ -1370,6 +1371,26 @@ class IntegrationProviderRelationship(RowLevelSecurityProtectedModel):
         ]
 
 
+class SAMLToken(models.Model):
+    id = models.UUIDField(primary_key=True, default=uuid4, editable=False)
+    inserted_at = models.DateTimeField(auto_now_add=True, editable=False)
+    updated_at = models.DateTimeField(auto_now=True, editable=False)
+    expires_at = models.DateTimeField(editable=False)
+    token = models.JSONField(unique=True)
+    user = models.ForeignKey(User, on_delete=models.CASCADE)
+
+    class Meta:
+        db_table = "saml_tokens"
+
+    def save(self, *args, **kwargs):
+        if not self.expires_at:
+            self.expires_at = datetime.now(timezone.utc) + timedelta(seconds=15)
+        super().save(*args, **kwargs)
+
+    def is_expired(self) -> bool:
+        return datetime.now(timezone.utc) >= self.expires_at
+
+
 class SAMLDomainIndex(models.Model):
     """
     Public index of SAML domains. No RLS. Used for fast lookup in SAML login flow.
@@ -1568,19 +1589,24 @@ class SAMLConfiguration(RowLevelSecurityProtectedModel):
             provider="saml", client_id=previous_email_domain or self.email_domain
         )
 
+        client_id = self.email_domain[:191]
+        name = f"SAML-{self.email_domain}"[:40]
+
         if social_app_qs.exists():
             social_app = social_app_qs.first()
-            social_app.client_id = self.email_domain
-            social_app.name = f"{self.tenant.name} SAML ({self.email_domain})"
+            social_app.client_id = client_id
+            social_app.name = name
             social_app.settings = settings_dict
+            social_app.provider_id = idp_settings["entity_id"]
             social_app.save()
             social_app.sites.set([current_site])
         else:
             social_app = SocialApp.objects.create(
                 provider="saml",
-                client_id=self.email_domain,
-                name=f"{self.tenant.name} SAML ({self.email_domain})",
+                client_id=client_id,
+                name=name,
                 settings=settings_dict,
+                provider_id=idp_settings["entity_id"],
             )
             social_app.sites.set([current_site])
 

api/src/backend/api/specs/v1.yaml

@@ -2877,6 +2877,180 @@ paths:
               schema:
                 $ref: '#/components/schemas/OpenApiResponseResponse'
           description: ''
+  /api/v1/lighthouse-configurations:
+    get:
+      operationId: lighthouse_configurations_list
+      description: Retrieve a list of all Lighthouse configurations.
+      summary: List all Lighthouse configurations
+      parameters:
+      - in: query
+        name: fields[lighthouse-configurations]
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - name
+            - api_key
+            - model
+            - temperature
+            - max_tokens
+            - business_context
+            - is_active
+            - inserted_at
+            - updated_at
+            - url
+        description: endpoint return only specific fields in the response on a per-type
+          basis by including a fields[TYPE] query parameter.
+        explode: false
+      - name: filter[search]
+        required: false
+        in: query
+        description: A search term.
+        schema:
+          type: string
+      - name: page[number]
+        required: false
+        in: query
+        description: A page number within the paginated result set.
+        schema:
+          type: integer
+      - name: page[size]
+        required: false
+        in: query
+        description: Number of results to return per page.
+        schema:
+          type: integer
+      - name: sort
+        required: false
+        in: query
+        description: '[list of fields to sort by](https://jsonapi.org/format/#fetching-sorting)'
+        schema:
+          type: array
+          items:
+            type: string
+            enum:
+            - name
+            - -name
+            - inserted_at
+            - -inserted_at
+            - updated_at
+            - -updated_at
+            - is_active
+            - -is_active
+        explode: false
+      tags:
+      - Lighthouse
+      security:
+      - jwtAuth: []
+      responses:
+        '200':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/PaginatedLighthouseConfigList'
+          description: ''
+    post:
+      operationId: lighthouse_configurations_create
+      description: Create a new Lighthouse configuration with the specified details.
+      summary: Create a new Lighthouse configuration
+      tags:
+      - Lighthouse
+      requestBody:
+        content:
+          application/vnd.api+json:
+            schema:
+              $ref: '#/components/schemas/LighthouseConfigCreateRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/LighthouseConfigCreateRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/LighthouseConfigCreateRequest'
+        required: true
+      security:
+      - jwtAuth: []
+      responses:
+        '201':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/LighthouseConfigCreateResponse'
+          description: ''
+  /api/v1/lighthouse-configurations/{id}:
+    patch:
+      operationId: lighthouse_configurations_partial_update
+      description: Update certain fields of an existing Lighthouse configuration.
+      summary: Partially update a Lighthouse configuration
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+        required: true
+      tags:
+      - Lighthouse
+      requestBody:
+        content:
+          application/vnd.api+json:
+            schema:
+              $ref: '#/components/schemas/PatchedLighthouseConfigUpdateRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/PatchedLighthouseConfigUpdateRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/PatchedLighthouseConfigUpdateRequest'
+        required: true
+      security:
+      - jwtAuth: []
+      responses:
+        '200':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/LighthouseConfigUpdateResponse'
+          description: ''
+    delete:
+      operationId: lighthouse_configurations_destroy
+      description: Remove a Lighthouse configuration by its ID.
+      summary: Delete a Lighthouse configuration
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+        required: true
+      tags:
+      - Lighthouse
+      security:
+      - jwtAuth: []
+      responses:
+        '204':
+          description: No response body
+  /api/v1/lighthouse-configurations/{id}/connection:
+    post:
+      operationId: lighthouse_configurations_connection_create
+      description: Verify the connection to the OpenAI API for a specific Lighthouse
+        configuration.
+      summary: Check the connection to the OpenAI API
+      parameters:
+      - in: path
+        name: id
+        schema:
+          type: string
+        required: true
+      tags:
+      - Lighthouse
+      security:
+      - jwtAuth: []
+      responses:
+        '202':
+          content:
+            application/vnd.api+json:
+              schema:
+                $ref: '#/components/schemas/OpenApiResponseResponse'
+          description: ''
   /api/v1/overviews/findings:
     get:
       operationId: overviews_findings_retrieve
@@ -8464,6 +8638,290 @@ components:
           $ref: '#/components/schemas/InvitationUpdate'
       required:
       - data
+    LighthouseConfig:
+      type: object
+      required:
+      - type
+      - id
+      additionalProperties: false
+      properties:
+        type:
+          allOf:
+          - $ref: '#/components/schemas/Type4bfEnum'
+          description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+            member is used to describe resource objects that share common attributes
+            and relationships.
+        id:
+          type: string
+          format: uuid
+        attributes:
+          type: object
+          properties:
+            name:
+              type: string
+              description: Name of the configuration
+              maxLength: 100
+              minLength: 3
+            api_key:
+              type: string
+            model:
+              enum:
+              - gpt-4o-2024-11-20
+              - gpt-4o-2024-08-06
+              - gpt-4o-2024-05-13
+              - gpt-4o
+              - gpt-4o-mini-2024-07-18
+              - gpt-4o-mini
+              type: string
+              description: |-
+                Must be one of the supported model names
+
+                * `gpt-4o-2024-11-20` - GPT-4o v2024-11-20
+                * `gpt-4o-2024-08-06` - GPT-4o v2024-08-06
+                * `gpt-4o-2024-05-13` - GPT-4o v2024-05-13
+                * `gpt-4o` - GPT-4o Default
+                * `gpt-4o-mini-2024-07-18` - GPT-4o Mini v2024-07-18
+                * `gpt-4o-mini` - GPT-4o Mini Default
+            temperature:
+              type: number
+              format: double
+              description: Must be between 0 and 1
+            max_tokens:
+              type: integer
+              maximum: 2147483647
+              minimum: -2147483648
+              description: Must be between 500 and 5000
+            business_context:
+              type: string
+              description: Additional business context for this AI model configuration
+            is_active:
+              type: boolean
+              readOnly: true
+            inserted_at:
+              type: string
+              format: date-time
+              readOnly: true
+            updated_at:
+              type: string
+              format: date-time
+              readOnly: true
+          required:
+          - name
+    LighthouseConfigCreate:
+      type: object
+      required:
+      - type
+      additionalProperties: false
+      properties:
+        type:
+          allOf:
+          - $ref: '#/components/schemas/Type4bfEnum'
+          description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+            member is used to describe resource objects that share common attributes
+            and relationships.
+        attributes:
+          type: object
+          properties:
+            name:
+              type: string
+              description: Name of the configuration
+              maxLength: 100
+              minLength: 3
+            api_key:
+              type: string
+              writeOnly: true
+            model:
+              enum:
+              - gpt-4o-2024-11-20
+              - gpt-4o-2024-08-06
+              - gpt-4o-2024-05-13
+              - gpt-4o
+              - gpt-4o-mini-2024-07-18
+              - gpt-4o-mini
+              type: string
+              description: |-
+                Must be one of the supported model names
+
+                * `gpt-4o-2024-11-20` - GPT-4o v2024-11-20
+                * `gpt-4o-2024-08-06` - GPT-4o v2024-08-06
+                * `gpt-4o-2024-05-13` - GPT-4o v2024-05-13
+                * `gpt-4o` - GPT-4o Default
+                * `gpt-4o-mini-2024-07-18` - GPT-4o Mini v2024-07-18
+                * `gpt-4o-mini` - GPT-4o Mini Default
+            temperature:
+              type: number
+              format: double
+              description: Must be between 0 and 1
+            max_tokens:
+              type: integer
+              maximum: 2147483647
+              minimum: -2147483648
+              description: Must be between 500 and 5000
+            business_context:
+              type: string
+              description: Additional business context for this AI model configuration
+            is_active:
+              type: boolean
+              readOnly: true
+            inserted_at:
+              type: string
+              format: date-time
+              readOnly: true
+            updated_at:
+              type: string
+              format: date-time
+              readOnly: true
+          required:
+          - name
+          - api_key
+    LighthouseConfigCreateRequest:
+      type: object
+      properties:
+        data:
+          type: object
+          required:
+          - type
+          additionalProperties: false
+          properties:
+            type:
+              type: string
+              description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+                member is used to describe resource objects that share common attributes
+                and relationships.
+              enum:
+              - lighthouse-configurations
+            attributes:
+              type: object
+              properties:
+                name:
+                  type: string
+                  minLength: 3
+                  description: Name of the configuration
+                  maxLength: 100
+                api_key:
+                  type: string
+                  writeOnly: true
+                  minLength: 1
+                model:
+                  enum:
+                  - gpt-4o-2024-11-20
+                  - gpt-4o-2024-08-06
+                  - gpt-4o-2024-05-13
+                  - gpt-4o
+                  - gpt-4o-mini-2024-07-18
+                  - gpt-4o-mini
+                  type: string
+                  description: |-
+                    Must be one of the supported model names
+
+                    * `gpt-4o-2024-11-20` - GPT-4o v2024-11-20
+                    * `gpt-4o-2024-08-06` - GPT-4o v2024-08-06
+                    * `gpt-4o-2024-05-13` - GPT-4o v2024-05-13
+                    * `gpt-4o` - GPT-4o Default
+                    * `gpt-4o-mini-2024-07-18` - GPT-4o Mini v2024-07-18
+                    * `gpt-4o-mini` - GPT-4o Mini Default
+                temperature:
+                  type: number
+                  format: double
+                  description: Must be between 0 and 1
+                max_tokens:
+                  type: integer
+                  maximum: 2147483647
+                  minimum: -2147483648
+                  description: Must be between 500 and 5000
+                business_context:
+                  type: string
+                  description: Additional business context for this AI model configuration
+                is_active:
+                  type: boolean
+                  readOnly: true
+                inserted_at:
+                  type: string
+                  format: date-time
+                  readOnly: true
+                updated_at:
+                  type: string
+                  format: date-time
+                  readOnly: true
+              required:
+              - name
+              - api_key
+      required:
+      - data
+    LighthouseConfigCreateResponse:
+      type: object
+      properties:
+        data:
+          $ref: '#/components/schemas/LighthouseConfigCreate'
+      required:
+      - data
+    LighthouseConfigUpdate:
+      type: object
+      required:
+      - type
+      - id
+      additionalProperties: false
+      properties:
+        type:
+          allOf:
+          - $ref: '#/components/schemas/Type4bfEnum'
+          description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+            member is used to describe resource objects that share common attributes
+            and relationships.
+        id:
+          type: string
+          format: uuid
+        attributes:
+          type: object
+          properties:
+            name:
+              type: string
+              description: Name of the configuration
+              maxLength: 100
+              minLength: 3
+            api_key:
+              type: string
+              writeOnly: true
+            model:
+              enum:
+              - gpt-4o-2024-11-20
+              - gpt-4o-2024-08-06
+              - gpt-4o-2024-05-13
+              - gpt-4o
+              - gpt-4o-mini-2024-07-18
+              - gpt-4o-mini
+              type: string
+              description: |-
+                Must be one of the supported model names
+
+                * `gpt-4o-2024-11-20` - GPT-4o v2024-11-20
+                * `gpt-4o-2024-08-06` - GPT-4o v2024-08-06
+                * `gpt-4o-2024-05-13` - GPT-4o v2024-05-13
+                * `gpt-4o` - GPT-4o Default
+                * `gpt-4o-mini-2024-07-18` - GPT-4o Mini v2024-07-18
+                * `gpt-4o-mini` - GPT-4o Mini Default
+            temperature:
+              type: number
+              format: double
+              description: Must be between 0 and 1
+            max_tokens:
+              type: integer
+              maximum: 2147483647
+              minimum: -2147483648
+              description: Must be between 500 and 5000
+            business_context:
+              type: string
+              description: Additional business context for this AI model configuration
+            is_active:
+              type: boolean
+              readOnly: true
+    LighthouseConfigUpdateResponse:
+      type: object
+      properties:
+        data:
+          $ref: '#/components/schemas/LighthouseConfigUpdate'
+      required:
+      - data
     Membership:
       type: object
       required:
@@ -8830,6 +9288,15 @@ components:
             $ref: '#/components/schemas/Invitation'
       required:
       - data
+    PaginatedLighthouseConfigList:
+      type: object
+      properties:
+        data:
+          type: array
+          items:
+            $ref: '#/components/schemas/LighthouseConfig'
+      required:
+      - data
     PaginatedMembershipList:
       type: object
       properties:
@@ -9153,6 +9620,73 @@ components:
                   title: roles
       required:
       - data
+    PatchedLighthouseConfigUpdateRequest:
+      type: object
+      properties:
+        data:
+          type: object
+          required:
+          - type
+          - id
+          additionalProperties: false
+          properties:
+            type:
+              type: string
+              description: The [type](https://jsonapi.org/format/#document-resource-object-identification)
+                member is used to describe resource objects that share common attributes
+                and relationships.
+              enum:
+              - lighthouse-configurations
+            id:
+              type: string
+              format: uuid
+            attributes:
+              type: object
+              properties:
+                name:
+                  type: string
+                  minLength: 3
+                  description: Name of the configuration
+                  maxLength: 100
+                api_key:
+                  type: string
+                  writeOnly: true
+                  minLength: 1
+                model:
+                  enum:
+                  - gpt-4o-2024-11-20
+                  - gpt-4o-2024-08-06
+                  - gpt-4o-2024-05-13
+                  - gpt-4o
+                  - gpt-4o-mini-2024-07-18
+                  - gpt-4o-mini
+                  type: string
+                  description: |-
+                    Must be one of the supported model names
+
+                    * `gpt-4o-2024-11-20` - GPT-4o v2024-11-20
+                    * `gpt-4o-2024-08-06` - GPT-4o v2024-08-06
+                    * `gpt-4o-2024-05-13` - GPT-4o v2024-05-13
+                    * `gpt-4o` - GPT-4o Default
+                    * `gpt-4o-mini-2024-07-18` - GPT-4o Mini v2024-07-18
+                    * `gpt-4o-mini` - GPT-4o Mini Default
+                temperature:
+                  type: number
+                  format: double
+                  description: Must be between 0 and 1
+                max_tokens:
+                  type: integer
+                  maximum: 2147483647
+                  minimum: -2147483648
+                  description: Must be between 500 and 5000
+                business_context:
+                  type: string
+                  description: Additional business context for this AI model configuration
+                is_active:
+                  type: boolean
+                  readOnly: true
+      required:
+      - data
     PatchedProviderGroupMembershipRequest:
       type: object
       properties:
@@ -9329,7 +9863,6 @@ components:
                     * `static` - Key-value pairs
                     * `role` - Role assumption
                     * `service_account` - GCP Service Account Key
-                  readOnly: true
                 secret:
                   oneOf:
                   - type: object
@@ -11087,7 +11620,6 @@ components:
                 * `static` - Key-value pairs
                 * `role` - Role assumption
                 * `service_account` - GCP Service Account Key
-              readOnly: true
             secret:
               oneOf:
               - type: object
@@ -12649,6 +13181,10 @@ components:
       type: string
       enum:
       - provider-groups
+    Type4bfEnum:
+      type: string
+      enum:
+      - lighthouse-configurations
     Type6bbEnum:
       type: string
       enum:
@@ -12970,3 +13506,7 @@ tags:
   description: Endpoints for managing third-party integrations, including registration,
     configuration, retrieval, and deletion of integrations such as S3, JIRA, or other
     services.
+- name: Lighthouse
+  description: Endpoints for managing Lighthouse configurations, including creation,
+    retrieval, updating, and deletion of configurations such as OpenAI keys, models,
+    and business context.

api/src/backend/api/tests/test_adapters.py

@@ -5,8 +5,6 @@ from allauth.socialaccount.models import SocialLogin
 from django.contrib.auth import get_user_model
 
 from api.adapters import ProwlerSocialAccountAdapter
-from api.db_router import MainRouter
-from api.models import Membership, SAMLConfiguration, Tenant
 
 User = get_user_model()
 
@@ -27,7 +25,8 @@ class TestProwlerSocialAccountAdapter:
 
         sociallogin = MagicMock(spec=SocialLogin)
         sociallogin.account = MagicMock()
-        sociallogin.account.provider = "saml"
+        sociallogin.provider = MagicMock()
+        sociallogin.provider.id = "saml"
         sociallogin.account.extra_data = {}
         sociallogin.user = create_test_user
         sociallogin.connect = MagicMock()
@@ -46,45 +45,12 @@ class TestProwlerSocialAccountAdapter:
 
         sociallogin = MagicMock(spec=SocialLogin)
         sociallogin.account = MagicMock()
-        sociallogin.account.provider = "github"
+        sociallogin.provider = MagicMock()
+        sociallogin.user = MagicMock()
+        sociallogin.provider.id = "saml"
         sociallogin.account.extra_data = {}
         sociallogin.connect = MagicMock()
 
         adapter.pre_social_login(rf.get("/"), sociallogin)
 
         sociallogin.connect.assert_not_called()
-
-    def test_save_user_saml_flow(
-        self,
-        rf,
-        saml_setup,
-        saml_sociallogin,
-    ):
-        adapter = ProwlerSocialAccountAdapter()
-        request = rf.get("/")
-        saml_sociallogin.user.email = saml_setup["email"]
-        saml_sociallogin.account.extra_data = {
-            "firstName": [],
-            "lastName": [],
-            "organization": [],
-            "userType": [],
-        }
-
-        tenant = Tenant.objects.using(MainRouter.admin_db).get(
-            id=saml_setup["tenant_id"]
-        )
-        saml_config = SAMLConfiguration.objects.using(MainRouter.admin_db).get(
-            tenant=tenant
-        )
-        assert saml_config.email_domain == saml_setup["domain"]
-
-        user = adapter.save_user(request, saml_sociallogin)
-
-        assert user.name == "N/A"
-        assert user.company_name == ""
-        assert user.email == saml_setup["email"]
-        assert (
-            Membership.objects.using(MainRouter.admin_db)
-            .filter(user=user, tenant=tenant)
-            .exists()
-        )

api/src/backend/api/tests/test_views.py

@@ -5,7 +5,10 @@ import os
 import tempfile
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
+from types import SimpleNamespace
 from unittest.mock import ANY, MagicMock, Mock, patch
+from urllib.parse import parse_qs, urlparse
+from uuid import uuid4
 
 import jwt
 import pytest
@@ -33,6 +36,7 @@ from api.models import (
     Role,
     RoleProviderGroupRelationship,
     SAMLConfiguration,
+    SAMLToken,
     Scan,
     StateChoices,
     Task,
@@ -1241,10 +1245,10 @@ class TestProviderViewSet:
                 ("uid.icontains", "1", 5),
                 ("alias", "aws_testing_1", 1),
                 ("alias.icontains", "aws", 2),
-                ("inserted_at", TODAY, 5),
-                ("inserted_at.gte", "2024-01-01", 5),
+                ("inserted_at", TODAY, 6),
+                ("inserted_at.gte", "2024-01-01", 6),
                 ("inserted_at.lte", "2024-01-01", 0),
-                ("updated_at.gte", "2024-01-01", 5),
+                ("updated_at.gte", "2024-01-01", 6),
                 ("updated_at.lte", "2024-01-01", 0),
             ]
         ),
@@ -1723,6 +1727,50 @@ class TestProviderSecretViewSet:
                     "kubeconfig_content": "kubeconfig-content",
                 },
             ),
+            # M365 with STATIC secret - no user or password
+            (
+                Provider.ProviderChoices.M365.value,
+                ProviderSecret.TypeChoices.STATIC,
+                {
+                    "client_id": "client-id",
+                    "client_secret": "client-secret",
+                    "tenant_id": "tenant-id",
+                },
+            ),
+            # M365 with user only
+            (
+                Provider.ProviderChoices.M365.value,
+                ProviderSecret.TypeChoices.STATIC,
+                {
+                    "client_id": "client-id",
+                    "client_secret": "client-secret",
+                    "tenant_id": "tenant-id",
+                    "user": "test@domain.com",
+                },
+            ),
+            # M365 with password only
+            (
+                Provider.ProviderChoices.M365.value,
+                ProviderSecret.TypeChoices.STATIC,
+                {
+                    "client_id": "client-id",
+                    "client_secret": "client-secret",
+                    "tenant_id": "tenant-id",
+                    "password": "supersecret",
+                },
+            ),
+            # M365 with user and password
+            (
+                Provider.ProviderChoices.M365.value,
+                ProviderSecret.TypeChoices.STATIC,
+                {
+                    "client_id": "client-id",
+                    "client_secret": "client-secret",
+                    "tenant_id": "tenant-id",
+                    "user": "test@domain.com",
+                    "password": "supersecret",
+                },
+            ),
         ],
     )
     def test_provider_secrets_create_valid(
@@ -1734,7 +1782,10 @@ class TestProviderSecretViewSet:
         secret_data,
     ):
         # Get the provider from the fixture and set its type
-        provider = Provider.objects.filter(provider=provider_type)[0]
+        try:
+            provider = Provider.objects.filter(provider=provider_type)[0]
+        except IndexError:
+            print(f"Provider {provider_type} not found")
 
         data = {
             "data": {
@@ -1987,6 +2038,104 @@ class TestProviderSecretViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    def test_provider_secrets_partial_update_with_secret_type(
+        self, authenticated_client, provider_secret_fixture
+    ):
+        provider_secret, *_ = provider_secret_fixture
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {
+                    "name": "new_name",
+                    "secret": {
+                        "service_account_key": {},
+                    },
+                    "secret_type": "service_account",
+                },
+                "relationships": {
+                    "provider": {
+                        "data": {
+                            "type": "providers",
+                            "id": str(provider_secret.provider.id),
+                        }
+                    }
+                },
+            }
+        }
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+        assert response.status_code == status.HTTP_200_OK
+        provider_secret.refresh_from_db()
+        assert provider_secret.name == "new_name"
+        assert provider_secret.secret == {"service_account_key": {}}
+
+    def test_provider_secrets_partial_update_with_invalid_secret_type(
+        self, authenticated_client, provider_secret_fixture
+    ):
+        provider_secret, *_ = provider_secret_fixture
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {
+                    "name": "new_name",
+                    "secret": {
+                        "service_account_key": {},
+                    },
+                    "secret_type": "static",
+                },
+                "relationships": {
+                    "provider": {
+                        "data": {
+                            "type": "providers",
+                            "id": str(provider_secret.provider.id),
+                        }
+                    }
+                },
+            }
+        }
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
+    def test_provider_secrets_partial_update_without_secret_type_but_different(
+        self, authenticated_client, provider_secret_fixture
+    ):
+        provider_secret, *_ = provider_secret_fixture
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {
+                    "name": "new_name",
+                    "secret": {
+                        "service_account_key": {},
+                    },
+                },
+                "relationships": {
+                    "provider": {
+                        "data": {
+                            "type": "providers",
+                            "id": str(provider_secret.provider.id),
+                        }
+                    }
+                },
+            }
+        }
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
 
 @pytest.mark.django_db
 class TestScanViewSet:
@@ -3329,6 +3478,61 @@ class TestFindingViewSet:
             ]
         }
 
+    def test_findings_metadata_backfill(
+        self, authenticated_client, scans_fixture, findings_fixture
+    ):
+        scan = scans_fixture[0]
+        scan.unique_resource_count = 1
+        scan.save()
+
+        with patch(
+            "api.v1.views.backfill_scan_resource_summaries_task.apply_async"
+        ) as mock_backfill_task:
+            response = authenticated_client.get(
+                reverse("finding-metadata"),
+                {"filter[scan]": str(scan.id)},
+            )
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill_task.assert_called()
+
+    def test_findings_metadata_backfill_no_resources(
+        self, authenticated_client, scans_fixture
+    ):
+        scan_id = str(scans_fixture[0].id)
+        with patch(
+            "api.v1.views.backfill_scan_resource_summaries_task.apply_async"
+        ) as mock_backfill_task:
+            response = authenticated_client.get(
+                reverse("finding-metadata"),
+                {"filter[scan]": scan_id},
+            )
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill_task.assert_not_called()
+
+    def test_findings_metadata_latest_backfill(
+        self, authenticated_client, scans_fixture, findings_fixture
+    ):
+        scan = scans_fixture[0]
+        scan.unique_resource_count = 1
+        scan.save()
+
+        with patch(
+            "api.v1.views.backfill_scan_resource_summaries_task.apply_async"
+        ) as mock_backfill_task:
+            response = authenticated_client.get(reverse("finding-metadata_latest"))
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill_task.assert_called()
+
+    def test_findings_metadata_latest_backfill_no_resources(
+        self, authenticated_client, scans_fixture
+    ):
+        with patch(
+            "api.v1.views.backfill_scan_resource_summaries_task.apply_async"
+        ) as mock_backfill_task:
+            response = authenticated_client.get(reverse("finding-metadata_latest"))
+        assert response.status_code == status.HTTP_200_OK
+        mock_backfill_task.assert_not_called()
+
     def test_findings_latest(self, authenticated_client, latest_scan_finding):
         response = authenticated_client.get(
             reverse("finding-latest"),
@@ -5561,6 +5765,76 @@ class TestIntegrationViewSet:
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
 
+@pytest.mark.django_db
+class TestSAMLTokenValidation:
+    def test_valid_token_returns_tokens(self, authenticated_client, create_test_user):
+        user = create_test_user
+        valid_token_data = {
+            "access": "mock_access_token",
+            "refresh": "mock_refresh_token",
+        }
+        saml_token = SAMLToken.objects.create(
+            token=valid_token_data,
+            user=user,
+            expires_at=datetime.now(timezone.utc) + timedelta(seconds=10),
+        )
+
+        url = reverse("token-saml")
+        response = authenticated_client.post(f"{url}?id={saml_token.id}")
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json() == {"data": valid_token_data}
+        assert not SAMLToken.objects.filter(id=saml_token.id).exists()
+
+    def test_invalid_token_id_returns_404(self, authenticated_client):
+        url = reverse("token-saml")
+        response = authenticated_client.post(f"{url}?id={str(uuid4())}")
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        assert response.json()["errors"]["detail"] == "Invalid token ID."
+
+    def test_expired_token_returns_400(self, authenticated_client, create_test_user):
+        user = create_test_user
+        expired_token_data = {
+            "access": "expired_access_token",
+            "refresh": "expired_refresh_token",
+        }
+        saml_token = SAMLToken.objects.create(
+            token=expired_token_data,
+            user=user,
+            expires_at=datetime.now(timezone.utc) - timedelta(seconds=1),
+        )
+
+        url = reverse("token-saml")
+        response = authenticated_client.post(f"{url}?id={saml_token.id}")
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert response.json()["errors"]["detail"] == "Token expired."
+        assert SAMLToken.objects.filter(id=saml_token.id).exists()
+
+    def test_token_can_be_used_only_once(self, authenticated_client, create_test_user):
+        user = create_test_user
+        token_data = {
+            "access": "single_use_token",
+            "refresh": "single_use_refresh",
+        }
+        saml_token = SAMLToken.objects.create(
+            token=token_data,
+            user=user,
+            expires_at=datetime.now(timezone.utc) + timedelta(seconds=10),
+        )
+
+        url = reverse("token-saml")
+
+        # First use: should succeed
+        response1 = authenticated_client.post(f"{url}?id={saml_token.id}")
+        assert response1.status_code == status.HTTP_200_OK
+
+        # Second use: should fail (already deleted)
+        response2 = authenticated_client.post(f"{url}?id={saml_token.id}")
+        assert response2.status_code == status.HTTP_404_NOT_FOUND
+
+
 @pytest.mark.django_db
 class TestSAMLInitiateAPIView:
     def test_valid_email_domain_and_certificates(
@@ -5575,11 +5849,11 @@ class TestSAMLInitiateAPIView:
         response = authenticated_client.post(url, data=payload, format="json")
 
         assert response.status_code == status.HTTP_302_FOUND
-        assert f"email={saml_setup['email']}" in response.url
         assert (
             reverse("saml_login", kwargs={"organization_slug": saml_setup["domain"]})
             in response.url
         )
+        assert "SAMLRequest" not in response.url
 
     def test_invalid_email_domain(self, authenticated_client):
         url = reverse("api_saml_initiate")
@@ -5590,21 +5864,6 @@ class TestSAMLInitiateAPIView:
         assert response.status_code == status.HTTP_403_FORBIDDEN
         assert response.json()["errors"]["detail"] == "Unauthorized domain."
 
-    def test_missing_certificates(self, authenticated_client, saml_setup, monkeypatch):
-        monkeypatch.setenv("SAML_PUBLIC_CERT", "")
-        monkeypatch.setenv("SAML_PRIVATE_KEY", "")
-
-        url = reverse("api_saml_initiate")
-        payload = {"email_domain": saml_setup["email"]}
-
-        response = authenticated_client.post(url, data=payload, format="json")
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-        assert (
-            response.json()["errors"]["detail"]
-            == "SAML configuration is invalid: missing certificates."
-        )
-
 
 @pytest.mark.django_db
 class TestSAMLConfigurationViewSet:
@@ -5752,14 +6011,15 @@ class TestTenantFinishACSView:
 
         assert isinstance(response, JsonResponse) or response.status_code in [200, 302]
 
-    def test_dispatch_sets_user_profile_and_assigns_role(
-        self, create_test_user, tenants_fixture, saml_setup
+    def test_dispatch_sets_user_profile_and_assigns_role_and_creates_token(
+        self, create_test_user, tenants_fixture, saml_setup, settings, monkeypatch
     ):
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
         user = create_test_user
-        original_email = user.email
         original_name = user.name
         original_company = user.company_name
-        user.email = f"doe@{saml_setup['email']}"
+        user.company_name = "testing_company"
+        user.is_authenticate = True
 
         social_account = SocialAccount(
             user=user,
@@ -5767,7 +6027,7 @@ class TestTenantFinishACSView:
             extra_data={
                 "firstName": ["John"],
                 "lastName": ["Doe"],
-                "organization": ["TestOrg"],
+                "organization": ["testing_company"],
                 "userType": ["saml_default_role"],
             },
         )
@@ -5781,32 +6041,46 @@ class TestTenantFinishACSView:
             patch(
                 "allauth.socialaccount.providers.saml.views.get_app_or_404"
             ) as mock_get_app_or_404,
-            patch("allauth.socialaccount.models.SocialApp.objects.get"),
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
             patch(
                 "allauth.socialaccount.models.SocialAccount.objects.get"
-            ) as mock_socialaccount_get,
-            patch("api.v1.serializers.TokenSocialLoginSerializer") as mock_serializer,
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
                 provider="saml", client_id="testtenant", name="Test App", settings={}
             )
-
-            mock_socialaccount_get.return_value = social_account
-
-            mock_instance = mock_serializer.return_value
-            mock_instance.is_valid.return_value = True
-            mock_instance.validated_data = {
-                "token": "mocktoken",
-                "refresh_token": "mockrefresh",
-            }
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(
+                tenant_id=tenants_fixture[0].id
+            )
+            mock_saml_config_get.return_value = MagicMock()
+            mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
             response = view(request, organization_slug="testtenant")
 
-        assert response.status_code == 200
+        assert response.status_code == 302
+
+        expected_callback_host = "localhost"
+        parsed_url = urlparse(response.url)
+        assert parsed_url.netloc == expected_callback_host
+        query_params = parse_qs(parsed_url.query)
+        assert "id" in query_params
+
+        token_id = query_params["id"][0]
+        token_obj = SAMLToken.objects.get(id=token_id)
+        assert token_obj.user == user
+        assert not token_obj.is_expired()
+
         user.refresh_from_db()
         assert user.name == "John Doe"
-        assert user.company_name == "TestOrg"
+        assert user.company_name == "testing_company"
 
         role = Role.objects.using(MainRouter.admin_db).get(name="saml_default_role")
         assert role.tenant == tenants_fixture[0]
@@ -5816,7 +6090,14 @@ class TestTenantFinishACSView:
             .filter(user=user, tenant_id=tenants_fixture[0].id)
             .exists()
         )
-        user.email = original_email
+
+        membership = Membership.objects.using(MainRouter.admin_db).get(
+            user=user, tenant=tenants_fixture[0]
+        )
+        assert membership.role == Membership.RoleChoices.MEMBER
+        assert membership.user == user
+        assert membership.tenant == tenants_fixture[0]
+
         user.name = original_name
         user.company_name = original_company
         user.save()

api/src/backend/api/v1/serializers.py

@@ -130,6 +130,12 @@ class TokenSerializer(BaseTokenSerializer):
 
 class TokenSocialLoginSerializer(BaseTokenSerializer):
     email = serializers.EmailField(write_only=True)
+    tenant_id = serializers.UUIDField(
+        write_only=True,
+        required=False,
+        help_text="If not provided, the tenant ID of the first membership that was added"
+        " to the user will be used.",
+    )
 
     # Output tokens
     refresh = serializers.CharField(read_only=True)
@@ -1200,8 +1206,8 @@ class M365ProviderSecret(serializers.Serializer):
     client_id = serializers.CharField()
     client_secret = serializers.CharField()
     tenant_id = serializers.CharField()
-    user = serializers.EmailField()
-    password = serializers.CharField()
+    user = serializers.EmailField(required=False)
+    password = serializers.CharField(required=False)
 
     class Meta:
         resource_name = "provider-secrets"
@@ -1309,12 +1315,13 @@ class ProviderSecretUpdateSerializer(BaseWriteProviderSecretSerializer):
             "inserted_at": {"read_only": True},
             "updated_at": {"read_only": True},
             "provider": {"read_only": True},
-            "secret_type": {"read_only": True},
+            "secret_type": {"required": False},
         }
 
     def validate(self, attrs):
         provider = self.instance.provider
-        secret_type = self.instance.secret_type
+        # To allow updating a secret with the same type without making the `secret_type` mandatory
+        secret_type = attrs.get("secret_type") or self.instance.secret_type
         secret = attrs.get("secret")
 
         validated_attrs = super().validate(attrs)

api/src/backend/api/v1/urls.py

@@ -1,9 +1,11 @@
+from allauth.socialaccount.providers.saml.views import ACSView, MetadataView, SLSView
 from django.urls import include, path
 from drf_spectacular.views import SpectacularRedocView
 from rest_framework_nested import routers
 
 from api.v1.views import (
     ComplianceOverviewViewSet,
+    CustomSAMLLoginView,
     CustomTokenObtainView,
     CustomTokenRefreshView,
     CustomTokenSwitchTenantView,
@@ -25,6 +27,7 @@ from api.v1.views import (
     RoleViewSet,
     SAMLConfigurationViewSet,
     SAMLInitiateAPIView,
+    SAMLTokenValidateView,
     ScanViewSet,
     ScheduleViewSet,
     SchemaView,
@@ -126,13 +129,32 @@ urlpatterns = [
     path(
         "auth/saml/initiate/", SAMLInitiateAPIView.as_view(), name="api_saml_initiate"
     ),
-    # Allauth SAML endpoints for tenants
-    path("accounts/", include("allauth.urls")),
     path(
-        "api/v1/accounts/saml/<organization_slug>/acs/finish/",
+        "accounts/saml/<organization_slug>/login/",
+        CustomSAMLLoginView.as_view(),
+        name="saml_login",
+    ),
+    path(
+        "accounts/saml/<organization_slug>/acs/",
+        ACSView.as_view(),
+        name="saml_acs",
+    ),
+    path(
+        "accounts/saml/<organization_slug>/acs/finish/",
         TenantFinishACSView.as_view(),
         name="saml_finish_acs",
     ),
+    path(
+        "accounts/saml/<organization_slug>/sls/",
+        SLSView.as_view(),
+        name="saml_sls",
+    ),
+    path(
+        "accounts/saml/<organization_slug>/metadata/",
+        MetadataView.as_view(),
+        name="saml_metadata",
+    ),
+    path("tokens/saml", SAMLTokenValidateView.as_view(), name="token-saml"),
     path("tokens/google", GoogleSocialLoginView.as_view(), name="token-google"),
     path("tokens/github", GithubSocialLoginView.as_view(), name="token-github"),
     path("", include(router.urls)),

api/src/backend/api/v1/views.py

@@ -1,12 +1,13 @@
 import glob
 import os
 from datetime import datetime, timedelta, timezone
+from urllib.parse import urljoin
 
 import sentry_sdk
 from allauth.socialaccount.models import SocialAccount, SocialApp
 from allauth.socialaccount.providers.github.views import GitHubOAuth2Adapter
 from allauth.socialaccount.providers.google.views import GoogleOAuth2Adapter
-from allauth.socialaccount.providers.saml.views import FinishACSView
+from allauth.socialaccount.providers.saml.views import FinishACSView, LoginView
 from botocore.exceptions import ClientError, NoCredentialsError, ParamValidationError
 from celery.result import AsyncResult
 from config.env import env
@@ -21,7 +22,7 @@ from django.contrib.postgres.search import SearchQuery
 from django.db import transaction
 from django.db.models import Count, Exists, F, OuterRef, Prefetch, Q, Sum
 from django.db.models.functions import Coalesce
-from django.http import HttpResponse, JsonResponse
+from django.http import HttpResponse
 from django.shortcuts import redirect
 from django.urls import reverse
 from django.utils.dateparse import parse_date
@@ -107,6 +108,7 @@ from api.models import (
     RoleProviderGroupRelationship,
     SAMLConfiguration,
     SAMLDomainIndex,
+    SAMLToken,
     Scan,
     ScanSummary,
     SeverityChoices,
@@ -401,17 +403,68 @@ class GithubSocialLoginView(SocialLoginView):
         return original_response
 
 
+@extend_schema(exclude=True)
+class SAMLTokenValidateView(GenericAPIView):
+    resource_name = "tokens"
+    http_method_names = ["post"]
+
+    def post(self, request):
+        token_id = request.query_params.get("id", "invalid")
+        try:
+            saml_token = SAMLToken.objects.using(MainRouter.admin_db).get(id=token_id)
+        except SAMLToken.DoesNotExist:
+            return Response({"detail": "Invalid token ID."}, status=404)
+
+        if saml_token.is_expired():
+            return Response({"detail": "Token expired."}, status=400)
+
+        token_data = saml_token.token
+        # Currently we don't store the tokens in the database, so we delete the token after use
+        saml_token.delete()
+
+        return Response(token_data, status=200)
+
+
+@extend_schema(exclude=True)
+class CustomSAMLLoginView(LoginView):
+    def dispatch(self, request, *args, **kwargs):
+        """
+        Convert GET requests to POST to bypass allauth's confirmation screen.
+
+        Why this is necessary:
+        - django-allauth requires POST for social logins to prevent open redirect attacks
+        - SAML login links typically use GET requests (e.g., <a href="...">)
+        - This conversion allows seamless login without user-facing confirmation
+
+        Security considerations:
+        1. Preserves CSRF protection: Original POST handling remains intact
+        2. Avoids global SOCIALACCOUNT_LOGIN_ON_GET=True which would:
+           - Enable GET logins for ALL providers (security risk)
+           - Potentially expose open redirect vulnerabilities
+        3. SAML payloads remain signed/encrypted regardless of HTTP method
+        4. No sensitive parameters are exposed in URLs (copied to POST body)
+
+        This approach maintains security while providing better UX.
+        """
+        if request.method == "GET":
+            # Convert GET to POST while preserving parameters
+            request.method = "POST"
+        return super().dispatch(request, *args, **kwargs)
+
+
 @extend_schema(exclude=True)
 class SAMLInitiateAPIView(GenericAPIView):
     serializer_class = SamlInitiateSerializer
     permission_classes = []
 
     def post(self, request, *args, **kwargs):
+        # Validate the input payload and extract the domain
         serializer = self.get_serializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         email = serializer.validated_data["email_domain"]
         domain = email.split("@", 1)[-1].lower()
 
+        # Retrieve the SAML configuration for the given email domain
         try:
             check = SAMLDomainIndex.objects.get(email_domain=domain)
             with rls_transaction(str(check.tenant_id)):
@@ -421,20 +474,24 @@ class SAMLInitiateAPIView(GenericAPIView):
                 {"detail": "Unauthorized domain."}, status=status.HTTP_403_FORBIDDEN
             )
 
-        # Check certificates are not empty
-        saml_public_cert = os.getenv("SAML_PUBLIC_CERT", "").strip()
-        saml_private_key = os.getenv("SAML_PRIVATE_KEY", "").strip()
+        # Check certificates are not empty (TODO: Validate certificates)
+        # saml_public_cert = os.getenv("SAML_PUBLIC_CERT", "").strip()
+        # saml_private_key = os.getenv("SAML_PRIVATE_KEY", "").strip()
 
-        if not saml_public_cert or not saml_private_key:
-            return Response(
-                {"detail": "SAML configuration is invalid: missing certificates."},
-                status=status.HTTP_403_FORBIDDEN,
-            )
+        # if not saml_public_cert or not saml_private_key:
+        #     return Response(
+        #         {"detail": "SAML configuration is invalid: missing certificates."},
+        #         status=status.HTTP_403_FORBIDDEN,
+        #     )
 
-        saml_login_url = reverse(
+        # Build the SAML login URL using the configured API host
+        api_host = os.getenv("API_BASE_URL")
+        login_path = reverse(
             "saml_login", kwargs={"organization_slug": config.email_domain}
         )
-        return redirect(f"{saml_login_url}?email={email}")
+        login_url = urljoin(api_host, login_path)
+
+        return redirect(login_url)
 
 
 @extend_schema_view(
@@ -498,14 +555,26 @@ class TenantFinishACSView(FinishACSView):
         if not user or not user.is_authenticated:
             return response
 
+        # Defensive check to avoid edge case failures due to inconsistent or incomplete data in the database
+        # This handles scenarios like partially deleted or missing related objects
         try:
+            check = SAMLDomainIndex.objects.get(email_domain=organization_slug)
+            with rls_transaction(str(check.tenant_id)):
+                SAMLConfiguration.objects.get(tenant_id=str(check.tenant_id))
             social_app = SocialApp.objects.get(
                 provider="saml", client_id=organization_slug
             )
+            user_id = User.objects.get(email=str(user)).id
             social_account = SocialAccount.objects.get(
-                user=user, provider=social_app.provider
+                user=str(user_id), provider=social_app.provider_id
             )
-        except (SocialApp.DoesNotExist, SocialAccount.DoesNotExist):
+        except (
+            SAMLDomainIndex.DoesNotExist,
+            SAMLConfiguration.DoesNotExist,
+            SocialApp.DoesNotExist,
+            SocialAccount.DoesNotExist,
+            User.DoesNotExist,
+        ):
             return response
 
         extra = social_account.extra_data
@@ -557,16 +626,30 @@ class TenantFinishACSView(FinishACSView):
             role=role,
             tenant_id=tenant.id,
         )
-
-        serializer = TokenSocialLoginSerializer(data={"email": user.email})
-        serializer.is_valid(raise_exception=True)
-        return JsonResponse(
-            {
-                "type": "saml-social-tokens",
-                "attributes": serializer.validated_data,
-            }
+        membership, _ = Membership.objects.using(MainRouter.admin_db).get_or_create(
+            user=user,
+            tenant=tenant,
+            defaults={
+                "user": user,
+                "tenant": tenant,
+                "role": Membership.RoleChoices.MEMBER,
+            },
         )
 
+        serializer = TokenSocialLoginSerializer(
+            data={"email": user.email, "tenant_id": str(tenant.id)}
+        )
+        serializer.is_valid(raise_exception=True)
+
+        token_data = serializer.validated_data
+        saml_token = SAMLToken.objects.using(MainRouter.admin_db).create(
+            token=token_data, user=user
+        )
+        callback_url = env.str("SAML_SSO_CALLBACK_URL")
+        redirect_url = f"{callback_url}?id={saml_token.id}"
+
+        return redirect(redirect_url)
+
 
 @extend_schema_view(
     list=extend_schema(
@@ -2066,9 +2149,12 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
 
         # ToRemove: Temporary fallback mechanism
         if not queryset.exists():
-            scan_ids = Scan.objects.filter(
+            raw_scans_ids = Scan.objects.filter(
                 tenant_id=tenant_id, **scan_based_filters
-            ).values_list("id", flat=True)
+            ).values_list("id", "unique_resource_count")
+            scan_ids = [
+                scan_id for scan_id, count in raw_scans_ids if count and count > 0
+            ]
             for scan_id in scan_ids:
                 backfill_scan_resource_summaries_task.apply_async(
                     kwargs={"tenant_id": tenant_id, "scan_id": scan_id}
@@ -2154,7 +2240,12 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
             .order_by("provider_id", "-inserted_at")
             .distinct("provider_id")
         )
-        latest_scans_ids = list(latest_scans_queryset.values_list("id", flat=True))
+        raw_latest_scans_ids = list(
+            latest_scans_queryset.values_list("id", "unique_resource_count")
+        )
+        latest_scans_ids = [
+            scan_id for scan_id, count in raw_latest_scans_ids if count and count > 0
+        ]
 
         queryset = ResourceScanSummary.objects.filter(
             tenant_id=tenant_id,
@@ -3050,7 +3141,7 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
 @extend_schema(tags=["Overview"])
 @extend_schema_view(
-    list=extend_schema(
+    providers=extend_schema(
         summary="Get aggregated provider data",
         description=(
             "Retrieve an aggregated overview of findings and resources grouped by providers. "

api/src/backend/config/django/base.py

@@ -11,6 +11,7 @@ SECRET_KEY = env("SECRET_KEY", default="secret")
 DEBUG = env.bool("DJANGO_DEBUG", default=False)
 ALLOWED_HOSTS = ["localhost", "127.0.0.1"]
 SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+USE_X_FORWARDED_HOST = True
 
 # Application definition
 
@@ -248,3 +249,7 @@ X_FRAME_OPTIONS = "DENY"
 SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
 
 DJANGO_DELETION_BATCH_SIZE = env.int("DJANGO_DELETION_BATCH_SIZE", 5000)
+
+# SAML requirement
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_SECURE = True

api/src/backend/config/settings/social_login.py

@@ -25,9 +25,18 @@ SOCIALACCOUNT_EMAIL_AUTHENTICATION = True
 SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT = True
 SOCIALACCOUNT_ADAPTER = "api.adapters.ProwlerSocialAccountAdapter"
 
-# SAML keys
-SAML_PUBLIC_CERT = env("SAML_PUBLIC_CERT", default="")
-SAML_PRIVATE_KEY = env("SAML_PRIVATE_KEY", default="")
+
+# def inline(pem: str) -> str:
+#     return "".join(
+#         line.strip()
+#         for line in pem.splitlines()
+#         if "CERTIFICATE" not in line and "KEY" not in line
+#     )
+
+
+# # SAML keys (TODO: Validate certificates)
+# SAML_PUBLIC_CERT = inline(env("SAML_PUBLIC_CERT", default=""))
+# SAML_PRIVATE_KEY = inline(env("SAML_PRIVATE_KEY", default=""))
 
 SOCIALACCOUNT_PROVIDERS = {
     "google": {
@@ -60,12 +69,14 @@ SOCIALACCOUNT_PROVIDERS = {
             "entity_id": "urn:prowler.com:sp",
         },
         "advanced": {
-            "x509cert": SAML_PUBLIC_CERT,
-            "private_key": SAML_PRIVATE_KEY,
+            # TODO: Validate certificates
+            # "x509cert": SAML_PUBLIC_CERT,
+            # "private_key": SAML_PRIVATE_KEY,
+            # "authn_request_signed": True,
+            # "want_message_signed": True,
+            # "want_assertion_signed": True,
+            "reject_idp_initiated_sso": False,
             "name_id_format": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
-            "authn_request_signed": True,
-            "want_assertion_signed": True,
-            "want_message_signed": True,
         },
     },
 }

api/src/backend/conftest.py

@@ -381,8 +381,14 @@ def providers_fixture(tenants_fixture):
         tenant_id=tenant.id,
         scanner_args={"key1": "value1", "key2": {"key21": "value21"}},
     )
+    provider6 = Provider.objects.create(
+        provider="m365",
+        uid="m365.test.com",
+        alias="m365_testing",
+        tenant_id=tenant.id,
+    )
 
-    return provider1, provider2, provider3, provider4, provider5
+    return provider1, provider2, provider3, provider4, provider5, provider6
 
 
 @pytest.fixture
@@ -1118,7 +1124,7 @@ def latest_scan_finding(authenticated_client, providers_fixture, resources_fixtu
 @pytest.fixture
 def saml_setup(tenants_fixture):
     tenant_id = tenants_fixture[0].id
-    domain = "example.com"
+    domain = "prowler.com"
 
     SAMLDomainIndex.objects.create(email_domain=domain, tenant_id=tenant_id)
 

api/src/backend/tasks/jobs/export.py

@@ -31,6 +31,7 @@ from prowler.lib.outputs.compliance.iso27001.iso27001_gcp import GCPISO27001
 from prowler.lib.outputs.compliance.iso27001.iso27001_kubernetes import (
     KubernetesISO27001,
 )
+from prowler.lib.outputs.compliance.iso27001.iso27001_m365 import M365ISO27001
 from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp_aws import AWSKISAISMSP
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_aws import AWSMitreAttack
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
@@ -90,6 +91,7 @@ COMPLIANCE_CLASS_MAP = {
     "m365": [
         (lambda name: name.startswith("cis_"), M365CIS),
         (lambda name: name == "prowler_threatscore_m365", ProwlerThreatScoreM365),
+        (lambda name: name.startswith("iso27001_"), M365ISO27001),
     ],
 }
 

api/src/backend/tasks/jobs/scan.py

@@ -26,7 +26,7 @@ from api.models import (
     StateChoices,
 )
 from api.models import StatusChoices as FindingStatus
-from api.utils import initialize_prowler_provider
+from api.utils import initialize_prowler_provider, return_prowler_provider
 from api.v1.serializers import ScanTaskSerializer
 from prowler.lib.outputs.finding import Finding as ProwlerFinding
 from prowler.lib.scan.scan import Scan as ProwlerScan
@@ -149,7 +149,8 @@ def perform_prowler_scan(
                 provider_instance.save()
 
         # If the provider is not connected, raise an exception outside the transaction.
-        # If raised within the transaction, the transaction will be rolled back and the provider will not be marked as not connected.
+        # If raised within the transaction, the transaction will be rolled back and the provider will not be marked
+        # as not connected.
         if exc:
             raise exc
 
@@ -526,7 +527,7 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
         with rls_transaction(tenant_id):
             scan_instance = Scan.objects.get(pk=scan_id)
             provider_instance = scan_instance.provider
-            prowler_provider = initialize_prowler_provider(provider_instance)
+            prowler_provider = return_prowler_provider(provider_instance)
 
         # Get check status data by region from findings
         check_status_by_region = {}

api/src/backend/tasks/tests/test_scan.py

@@ -399,9 +399,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -427,9 +425,7 @@ class TestCreateComplianceRequirements:
                 "us-east-1",
                 "us-west-2",
             ]
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {
                 "cis_1.4_aws": {
@@ -512,9 +508,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -557,9 +551,7 @@ class TestCreateComplianceRequirements:
                 "us-east-1",
                 "us-west-2",
             ]
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {
                 "test_compliance": {
@@ -607,9 +599,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -641,9 +631,7 @@ class TestCreateComplianceRequirements:
             mock_prowler_provider_instance.get_regions.side_effect = AttributeError(
                 "No get_regions method"
             )
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {
                 "kubernetes_cis": {
@@ -676,9 +664,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -704,9 +690,7 @@ class TestCreateComplianceRequirements:
 
             mock_prowler_provider_instance = MagicMock()
             mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {
                 "cis_1.4_aws": {
@@ -743,9 +727,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
         ):
             tenant = tenants_fixture[0]
             scan = scans_fixture[0]
@@ -759,7 +741,7 @@ class TestCreateComplianceRequirements:
             tenant_id = str(tenant.id)
             scan_id = str(scan.id)
 
-            mock_initialize_prowler_provider.side_effect = Exception(
+            mock_prowler_provider.side_effect = Exception(
                 "Provider initialization failed"
             )
 
@@ -774,9 +756,7 @@ class TestCreateComplianceRequirements:
     ):
         with (
             patch("api.db_utils.rls_transaction"),
-            patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+            patch("tasks.jobs.scan.return_prowler_provider") as mock_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -800,9 +780,7 @@ class TestCreateComplianceRequirements:
 
             mock_prowler_provider_instance = MagicMock()
             mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {}
 
@@ -821,8 +799,8 @@ class TestCreateComplianceRequirements:
         with (
             patch("api.db_utils.rls_transaction"),
             patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+                "tasks.jobs.scan.return_prowler_provider"
+            ) as mock_return_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -862,9 +840,7 @@ class TestCreateComplianceRequirements:
 
             mock_prowler_provider_instance = MagicMock()
             mock_prowler_provider_instance.get_regions.return_value = ["us-east-1"]
-            mock_initialize_prowler_provider.return_value = (
-                mock_prowler_provider_instance
-            )
+            mock_return_prowler_provider.return_value = mock_prowler_provider_instance
 
             mock_compliance_template.__getitem__.return_value = {
                 "cis_1.4_aws": {
@@ -898,8 +874,8 @@ class TestCreateComplianceRequirements:
         with (
             patch("api.db_utils.rls_transaction"),
             patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+                "tasks.jobs.scan.return_prowler_provider"
+            ) as mock_return_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -911,7 +887,6 @@ class TestCreateComplianceRequirements:
         ):
             tenant = tenants_fixture[0]
             scan = scans_fixture[0]
-            providers_fixture[0]
 
             mock_findings_filter.return_value = []
 
@@ -921,7 +896,7 @@ class TestCreateComplianceRequirements:
                 "us-west-2",
                 "eu-west-1",
             ]
-            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+            mock_return_prowler_provider.return_value = mock_prowler_provider
 
             mock_compliance_template.__getitem__.return_value = {
                 "test_compliance": {
@@ -990,8 +965,8 @@ class TestCreateComplianceRequirements:
         with (
             patch("api.db_utils.rls_transaction"),
             patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+                "tasks.jobs.scan.return_prowler_provider"
+            ) as mock_return_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -1009,7 +984,7 @@ class TestCreateComplianceRequirements:
 
             mock_prowler_provider = MagicMock()
             mock_prowler_provider.get_regions.return_value = ["us-east-1", "us-west-2"]
-            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+            mock_return_prowler_provider.return_value = mock_prowler_provider
 
             mock_compliance_template.__getitem__.return_value = {
                 "test_compliance": {
@@ -1077,8 +1052,8 @@ class TestCreateComplianceRequirements:
         with (
             patch("api.db_utils.rls_transaction"),
             patch(
-                "tasks.jobs.scan.initialize_prowler_provider"
-            ) as mock_initialize_prowler_provider,
+                "tasks.jobs.scan.return_prowler_provider"
+            ) as mock_return_prowler_provider,
             patch(
                 "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
             ) as mock_compliance_template,
@@ -1090,13 +1065,12 @@ class TestCreateComplianceRequirements:
         ):
             tenant = tenants_fixture[0]
             scan = scans_fixture[0]
-            providers_fixture[0]
 
             mock_findings_filter.return_value = []
 
             mock_prowler_provider = MagicMock()
             mock_prowler_provider.get_regions.return_value = ["us-east-1", "us-west-2"]
-            mock_initialize_prowler_provider.return_value = mock_prowler_provider
+            mock_return_prowler_provider.return_value = mock_prowler_provider
 
             mock_compliance_template.__getitem__.return_value = {
                 "test_compliance": {

dashboard/lib/cards.py

@@ -4,7 +4,10 @@ from dash import html
 
 
 def create_provider_card(
-    provider: str, provider_logo: str, account_type: str, filtered_data
+    provider: str,
+    provider_logo: str,
+    account_type: str,
+    filtered_data,
 ) -> List[html.Div]:
     """
     Card to display the provider's name and icon.

dashboard/lib/dropdowns.py

@@ -245,6 +245,31 @@ def create_service_dropdown(services: list) -> html.Div:
     )
 
 
+def create_provider_dropdown(providers: list) -> html.Div:
+    """
+    Dropdown to select the provider.
+    Args:
+        providers (list): List of providers.
+    Returns:
+        html.Div: Dropdown to select the provider.
+    """
+    return html.Div(
+        [
+            html.Label(
+                "Provider:", className="text-prowler-stone-900 font-bold text-sm"
+            ),
+            dcc.Dropdown(
+                id="provider-filter",
+                options=[{"label": i, "value": i} for i in providers],
+                value=["All"],
+                clearable=False,
+                multi=True,
+                style={"color": "#000000"},
+            ),
+        ],
+    )
+
+
 def create_status_dropdown(status: list) -> html.Div:
     """
     Dropdown to select the status.

dashboard/lib/layouts.py

@@ -9,9 +9,11 @@ def create_layout_overview(
     download_button_xlsx: html.Button,
     severity_dropdown: html.Div,
     service_dropdown: html.Div,
+    provider_dropdown: html.Div,
     table_row_dropdown: html.Div,
     status_dropdown: html.Div,
     table_div_header: html.Div,
+    amount_providers: int,
 ) -> html.Div:
     """
     Create the layout of the dashboard.
@@ -47,9 +49,10 @@ def create_layout_overview(
                 [
                     html.Div([severity_dropdown], className=""),
                     html.Div([service_dropdown], className=""),
+                    html.Div([provider_dropdown], className=""),
                     html.Div([status_dropdown], className=""),
                 ],
-                className="grid gap-x-4 mb-[30px] sm:grid-cols-2 lg:grid-cols-3",
+                className="grid gap-x-4 mb-[30px] sm:grid-cols-2 lg:grid-cols-4",
             ),
             html.Div(
                 [
@@ -59,7 +62,7 @@ def create_layout_overview(
                     html.Div(className="flex", id="k8s_card", n_clicks=0),
                     html.Div(className="flex", id="m365_card", n_clicks=0),
                 ],
-                className="grid gap-x-4 mb-[30px] sm:grid-cols-2 lg:grid-cols-5",
+                className=f"grid gap-x-4 mb-[30px] sm:grid-cols-2 lg:grid-cols-{amount_providers}",
             ),
             html.H4(
                 "Count of Findings by severity",

dashboard/pages/compliance.py

@@ -346,34 +346,27 @@ def display_data(
         if item == "nan" or item.__class__.__name__ != "str":
             region_filter_options.remove(item)
 
+    # Convert ASSESSMENTDATE to datetime
     data["ASSESSMENTDATE"] = pd.to_datetime(data["ASSESSMENTDATE"], errors="coerce")
-    data["ASSESSMENTDATE"] = data["ASSESSMENTDATE"].dt.strftime("%Y-%m-%d %H:%M:%S")
+    data["ASSESSMENTDAY"] = data["ASSESSMENTDATE"].dt.date
 
-    # Choosing the date that is the most recent
-    data_values = data["ASSESSMENTDATE"].unique()
-    data_values.sort()
-    data_values = data_values[::-1]
-    aux = []
+    # Find the latest timestamp per account per day
+    latest_per_account_day = data.groupby(["ACCOUNTID", "ASSESSMENTDAY"])[
+        "ASSESSMENTDATE"
+    ].transform("max")
 
-    data_values = [str(i) for i in data_values]
-    for value in data_values:
-        if value.split(" ")[0] not in [aux[i].split(" ")[0] for i in range(len(aux))]:
-            aux.append(value)
-    data_values = [str(i) for i in aux]
+    # Keep only rows with the latest timestamp for each account and day
+    data = data[data["ASSESSMENTDATE"] == latest_per_account_day]
 
-    data = data[data["ASSESSMENTDATE"].isin(data_values)]
-    data["ASSESSMENTDATE"] = data["ASSESSMENTDATE"].apply(lambda x: x.split(" ")[0])
+    # Prepare the date filter options (unique days, as strings)
+    options_date = sorted(data["ASSESSMENTDAY"].astype(str).unique(), reverse=True)
 
-    options_date = data["ASSESSMENTDATE"].unique()
-    options_date.sort()
-    options_date = options_date[::-1]
-
-    # Filter DATE
+    # Filter by selected date (as string)
     if date_filter_analytics in options_date:
-        data = data[data["ASSESSMENTDATE"] == date_filter_analytics]
+        data = data[data["ASSESSMENTDAY"].astype(str) == date_filter_analytics]
     else:
         date_filter_analytics = options_date[0]
-        data = data[data["ASSESSMENTDATE"] == date_filter_analytics]
+        data = data[data["ASSESSMENTDAY"].astype(str) == date_filter_analytics]
 
     if data.empty:
         fig = px.pie()

dashboard/pages/overview.py

@@ -38,6 +38,7 @@ from dashboard.lib.cards import create_provider_card
 from dashboard.lib.dropdowns import (
     create_account_dropdown,
     create_date_dropdown,
+    create_provider_dropdown,
     create_region_dropdown,
     create_service_dropdown,
     create_severity_dropdown,
@@ -298,6 +299,13 @@ else:
 
     service_dropdown = create_service_dropdown(services)
 
+    # Provider Dropdown
+    providers = ["All"] + list(data["PROVIDER"].unique())
+    providers = [
+        x for x in providers if str(x) != "nan" and x.__class__.__name__ == "str"
+    ]
+    provider_dropdown = create_provider_dropdown(providers)
+
     # Create the download button
     download_button_csv = html.Button(
         "Download this table as CSV",
@@ -479,9 +487,11 @@ else:
         download_button_xlsx,
         severity_dropdown,
         service_dropdown,
+        provider_dropdown,
         table_row_dropdown,
         status_dropdown,
         table_div_header,
+        len(data["PROVIDER"].unique()),
     )
 
 
@@ -508,6 +518,8 @@ else:
         Output("severity-filter", "value"),
         Output("severity-filter", "options"),
         Output("service-filter", "value"),
+        Output("provider-filter", "value"),
+        Output("provider-filter", "options"),
         Output("service-filter", "options"),
         Output("table-rows", "value"),
         Output("table-rows", "options"),
@@ -526,6 +538,7 @@ else:
     Input("download_link_xlsx", "n_clicks"),
     Input("severity-filter", "value"),
     Input("service-filter", "value"),
+    Input("provider-filter", "value"),
     Input("table-rows", "value"),
     Input("status-filter", "value"),
     Input("search-input", "value"),
@@ -549,6 +562,7 @@ def filter_data(
     n_clicks_xlsx,
     severity_values,
     service_values,
+    provider_values,
     table_row_values,
     status_values,
     search_value,
@@ -874,6 +888,25 @@ def filter_data(
         filtered_data["SERVICE_NAME"].isin(updated_service_values)
     ]
 
+    provider_filter_options = ["All"] + list(filtered_data["PROVIDER"].unique())
+
+    # Filter Provider
+    if provider_values == ["All"]:
+        updated_provider_values = filtered_data["PROVIDER"].unique()
+    elif "All" in provider_values and len(provider_values) > 1:
+        # Remove 'All' from the list
+        provider_values.remove("All")
+        updated_provider_values = provider_values
+    elif len(provider_values) == 0:
+        updated_provider_values = filtered_data["PROVIDER"].unique()
+        provider_values = ["All"]
+    else:
+        updated_provider_values = provider_values
+
+    filtered_data = filtered_data[
+        filtered_data["PROVIDER"].isin(updated_provider_values)
+    ]
+
     # Filter Status
     if status_values == ["All"]:
         updated_status_values = filtered_data["STATUS"].unique()
@@ -1094,25 +1127,17 @@ def filter_data(
 
         table_row_options = []
 
-        # Take the values from the table_row_values
+        # Calculate table row options as percentages
+        percentages = [0.05, 0.10, 0.25, 0.50, 0.75, 1.0]
+        total_rows = len(filtered_data)
+        for pct in percentages:
+            value = max(1, int(total_rows * pct))
+            label = f"{int(pct * 100)}%"
+            table_row_options.append({"label": label, "value": value})
+
+        # Default to 25% if not set
         if table_row_values is None or table_row_values == -1:
-            if len(filtered_data) < 25:
-                table_row_values = len(filtered_data)
-            else:
-                table_row_values = 25
-
-        if len(filtered_data) < 25:
-            table_row_values = len(filtered_data)
-
-        if len(filtered_data) >= 25:
-            table_row_options.append(25)
-        if len(filtered_data) >= 50:
-            table_row_options.append(50)
-        if len(filtered_data) >= 75:
-            table_row_options.append(75)
-        if len(filtered_data) >= 100:
-            table_row_options.append(100)
-        table_row_options.append(len(filtered_data))
+            table_row_values = table_row_options[0]["value"]
 
         # For the values that are nan or none, replace them with ""
         filtered_data = filtered_data.replace({np.nan: ""})
@@ -1347,21 +1372,36 @@ def filter_data(
     ]
 
     # Create Provider Cards
-    aws_card = create_provider_card(
-        "aws", aws_provider_logo, "Accounts", full_filtered_data
-    )
-    azure_card = create_provider_card(
-        "azure", azure_provider_logo, "Subscriptions", full_filtered_data
-    )
-    gcp_card = create_provider_card(
-        "gcp", gcp_provider_logo, "Projects", full_filtered_data
-    )
-    k8s_card = create_provider_card(
-        "kubernetes", ks8_provider_logo, "Clusters", full_filtered_data
-    )
-    m365_card = create_provider_card(
-        "m365", m365_provider_logo, "Accounts", full_filtered_data
-    )
+    if "aws" in list(data["PROVIDER"].unique()):
+        aws_card = create_provider_card(
+            "aws", aws_provider_logo, "Accounts", full_filtered_data
+        )
+    else:
+        aws_card = None
+    if "azure" in list(data["PROVIDER"].unique()):
+        azure_card = create_provider_card(
+            "azure", azure_provider_logo, "Subscriptions", full_filtered_data
+        )
+    else:
+        azure_card = None
+    if "gcp" in list(data["PROVIDER"].unique()):
+        gcp_card = create_provider_card(
+            "gcp", gcp_provider_logo, "Projects", full_filtered_data
+        )
+    else:
+        gcp_card = None
+    if "kubernetes" in list(data["PROVIDER"].unique()):
+        k8s_card = create_provider_card(
+            "kubernetes", ks8_provider_logo, "Clusters", full_filtered_data
+        )
+    else:
+        k8s_card = None
+    if "m365" in list(data["PROVIDER"].unique()):
+        m365_card = create_provider_card(
+            "m365", m365_provider_logo, "Accounts", full_filtered_data
+        )
+    else:
+        m365_card = None
 
     # Subscribe to Prowler Cloud card
     subscribe_card = [
@@ -1445,6 +1485,8 @@ def filter_data(
             severity_values,
             severity_filter_options,
             service_values,
+            provider_values,
+            provider_filter_options,
             service_filter_options,
             table_row_values,
             table_row_options,

docs/developer-guide/checks.md

@@ -212,34 +212,9 @@ Each check **must** populate the report with an unique identifier for the audite
     - Resource Name — `report.resource_name`.
         - The name of the Github resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`.
 
-### Using the Audit Configuration
+### Configurable Checks in Prowler
 
-Prowler has a [configuration file](../tutorials/configuration_file.md) which is used to pass certain configuration values to the checks. For example:
-
-```python title="ec2_securitygroup_with_many_ingress_egress_rules.py"
-class ec2_securitygroup_with_many_ingress_egress_rules(Check):
-    def execute(self):
-        findings = []
-
-        max_security_group_rules = ec2_client.audit_config.get(
-            "max_security_group_rules", 50
-        )
-        for security_group_arn, security_group in ec2_client.security_groups.items():
-```
-
-We use the `audit_config` object to retrieve the value of `max_security_group_rules`, which is the default value of 50 if the configuration value is not present.
-
-The configuration file is located at [`prowler/config/config.yaml`](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml) and is used to pass certain configuration values to the checks. For example:
-
-```yaml title="config.yaml"
-  aws:
-    max_security_group_rules: 50
-```
-
-This `audit_config` object is a Python dictionary that stores values read from the configuration file. It can be accessed by the check using the `audit_config` attribute of the service client.
-
-???+ note
-    Always use the `dictionary.get(value, default)` syntax to ensure a default value is set when the configuration value is not present.
+See [Configurable Checks](./configurable-checks.md) for detailed information on making checks configurable using the `audit_config` object and configuration file.
 
 ## Metadata Structure for Prowler Checks
 

docs/developer-guide/configurable-checks.md

@@ -0,0 +1,46 @@
+# Configurable Checks in Prowler
+
+Prowler empowers users to extend and adapt cloud security coverage by making checks configurable through the use of the `audit_config` object. This approach enables customization of checks to meet specific requirements through a configuration file.
+
+## Understanding the `audit_config` Object
+
+The `audit_config` object is a dictionary attached to each provider's service client (for example, `<service_name>_client.audit_config`). This object loads configuration values from the main configuration file (`prowler/config/config.yaml`). Use `audit_config` to make checks flexible and user-configurable.
+
+## Using `audit_config` to Configure Checks
+
+Retrieve configuration values in a check by using the `.get()` method on the `audit_config` object. For example, to get the minimum number of Availability Zones for Lambda from the configuration file, use the following code. If the value is not set in the configuration, the check defaults to 2:
+
+```python
+LAMBDA_MIN_AZS = awslambda_client.audit_config.get("lambda_min_azs", 2)
+```
+
+Always provide a default value in `.get()` to ensure the check works even if the configuration is missing the variable.
+
+### Example: Security Group Rule Limit
+
+```python title="ec2_securitygroup_with_many_ingress_egress_rules.py"
+class ec2_securitygroup_with_many_ingress_egress_rules(Check):
+    def execute(self):
+        findings = []
+        max_security_group_rules = ec2_client.audit_config.get(
+            "max_security_group_rules", 50
+        )
+        for security_group_arn, security_group in ec2_client.security_groups.items():
+            # ... check logic ...
+```
+
+## Required File Updates for Configurable Variables
+
+When adding a new configurable check to Prowler, update the following files:
+
+- **Configuration File:** Add the new variable under the relevant provider or service section in `prowler/config/config.yaml`.
+  ```yaml
+  # aws.awslambda_function_vpc_multi_az
+  lambda_min_azs: 2
+  ```
+- **Test Fixtures:** If tests depend on this configuration, add the variable to `tests/config/fixtures/config.yaml`.
+- **Documentation:** Document the new variable in the list of configurable checks in `docs/tutorials/configuration_file.md`.
+
+For a complete list of checks that already support configuration, see the [Configuration File Tutorial](../tutorials/configuration_file.md).
+
+This approach ensures that checks are easily configurable, making Prowler highly adaptable to different environments and requirements.

docs/developer-guide/introduction.md

@@ -164,3 +164,13 @@ If you enjoy swag, we’d love to thank you for your contribution with laptop st
 To request swag: Share your pull request details in our [Slack workspace](https://goto.prowler.com/slack).
 
 You can also reach out to Toni de la Fuente on [Twitter](https://twitter.com/ToniBlyx)—his DMs are open!
+
+# Testing a Pull Request from a Specific Branch
+
+To test Prowler from a specific branch (for example, to try out changes from a pull request before it is merged), you can use `pipx` to install directly from GitHub:
+
+```sh
+pipx install "git+https://github.com/prowler-cloud/prowler.git@branch-name"
+```
+
+Replace `branch-name` with the name of the branch you want to test. This will install Prowler in an isolated environment, allowing you to try out the changes safely.

docs/developer-guide/lighthouse.md

@@ -0,0 +1,134 @@
+# Extending Prowler Lighthouse
+
+This guide helps developers customize and extend Prowler Lighthouse by adding or modifying AI agents.
+
+## Understanding AI Agents
+
+AI agents combine Large Language Models (LLMs) with specialized tools that provide environmental context. These tools can include API calls, system command execution, or any function-wrapped capability.
+
+### Types of AI Agents
+
+AI agents fall into two main categories:
+
+- **Autonomous Agents**: Freely chooses from available tools to complete tasks, adapting their approach based on context. They decide which tools to use and when.
+- **Workflow Agents**: Follows structured paths with predefined logic. They execute specific tool sequences and can include conditional logic.
+
+Prowler Lighthouse is an autonomous agent - selecting the right tool(s) based on the users query.
+
+???+ note
+    To learn more about AI agents, read [Anthropic's blog post on building effective agents](https://www.anthropic.com/engineering/building-effective-agents).
+
+### LLM Dependency
+
+The autonomous nature of agents depends on the underlying LLM. Autonomous agents using identical system prompts and tools but powered by different LLM providers might approach user queries differently. Agent with one LLM might solve a problem efficiently, while with another it might take a different route or fail entirely.
+
+After evaluating multiple LLM providers (OpenAI, Gemini, Claude, LLama) based on tool calling features and response accuracy, we recommend using the `gpt-4o` model.
+
+## Prowler Lighthouse Architecture
+
+Prowler Lighthouse uses a multi-agent architecture orchestrated by the [Langgraph-Supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor) library.
+
+### Architecture Components
+
+<img src="../../tutorials/img/lighthouse-architecture.png" alt="Prowler Lighthouse architecture">
+
+Prowler Lighthouse integrates with the NextJS application:
+
+- The [Langgraph-Supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor) library integrates directly with NextJS
+- The system uses the authenticated user session to interact with the Prowler API server
+- Agents only access data the current user is authorized to view
+- Session management operates automatically, ensuring Role-Based Access Control (RBAC) is maintained
+
+## Available Prowler AI Agents
+
+The following specialized AI agents are available in Prowler:
+
+### Agent Overview
+
+- **provider_agent**: Fetches information about cloud providers connected to Prowler
+- **user_info_agent**: Retrieves information about Prowler users
+- **scans_agent**: Fetches information about Prowler scans
+- **compliance_agent**: Retrieves compliance overviews across scans
+- **findings_agent**: Fetches information about individual findings across scans
+- **overview_agent**: Retrieves overview information (providers, findings by status and severity, etc.)
+
+## How to Add New Capabilities
+
+### Updating the Supervisor Prompt
+
+The supervisor agent controls system behavior, tone, and capabilities. You can find the supervisor prompt at: [https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts](https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts)
+
+#### Supervisor Prompt Modifications
+
+Modifying the supervisor prompt allows you to:
+
+- Change personality or response style
+- Add new high-level capabilities
+- Modify task delegation to specialized agents
+- Set up guardrails (query types to answer or decline)
+
+???+ note
+    The supervisor agent should not have its own tools. This design keeps the system modular and maintainable.
+
+### How to Create New Specialized Agents
+
+The supervisor agent and all specialized agents are defined in the `route.ts` file. The supervisor agent uses [langgraph-supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor), while other agents use the prebuilt [create-react-agent](https://langchain-ai.github.io/langgraphjs/how-tos/create-react-agent/).
+
+To add new capabilities or all Lighthouse to interact with other APIs, create additional specialized agents:
+
+1. First determine what the new agent would do. Create a detailed prompt defining the agent's purpose and capabilities. You can see an example from [here](https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts#L359-L385).
+???+ note
+    Ensure that the new agent's capabilities don't collide with existing agents. For example, if there's already a *findings_agent* that talks to findings APIs don't create a new agent to do the same.
+
+2. Create necessary tools for the agents to access specific data or perform actions. A tool is a specialized function that extends the capabilities of LLM by allowing it to access external data or APIs. A tool is triggered by LLM based on the description of the tool and the user's query.
+For example, the description of `getScanTool` is "Fetches detailed information about a specific scan by its ID." If the description doesn't convey what the tool is capable of doing, LLM will not invoke the function. If the description of `getScanTool` was set to something random or not set at all, LLM will not answer queries like "Give me the critical issues from the scan ID xxxxxxxxxxxxxxx"
+???+ note
+    Ensure that one tool is added to one agent only. Adding tools is optional. There can be agents with no tools at all.
+
+3. Use the `createReactAgent` function to define a new agent. For example, the rolesAgent name is "roles_agent" and has access to call tools "*getRolesTool*" and "*getRoleTool*"
+```js
+const rolesAgent = createReactAgent({
+  llm: llm,
+  tools: [getRolesTool, getRoleTool],
+  name: "roles_agent",
+  prompt: rolesAgentPrompt,
+});
+```
+
+4. Create a detailed prompt defining the agent's purpose and capabilities.
+
+5. Add the new agent to the available agents list:
+```js
+const agents = [
+  userInfoAgent,
+  providerAgent,
+  overviewAgent,
+  scansAgent,
+  complianceAgent,
+  findingsAgent,
+  rolesAgent,  // New agent added here
+];
+// Create supervisor workflow
+const workflow = createSupervisor({
+  agents: agents,
+  llm: supervisorllm,
+  prompt: supervisorPrompt,
+  outputMode: "last_message",
+});
+```
+
+6. Update the supervisor's system prompt to summarize the new agent's capabilities.
+
+### Best Practices for Agent Development
+
+When developing new agents or capabilities:
+
+- **Clear Responsibility Boundaries**: Each agent should have a defined purpose with minimal overlap. No two agents should access the same tools or different tools accessing the same Prowler APIs.
+- **Minimal Data Access**: Agents should only request the data they need, keeping requests specific to minimize context window usage, cost, and response time.
+- **Thorough Prompting:** Ensure agent prompts include clear instructions about:
+    - The agent's purpose and limitations
+    - How to use its tools
+    - How to format responses for the supervisor
+    - Error handling procedures (Optional)
+- **Security Considerations:** Agents should never modify data or access sensitive information like secrets or credentials.
+- **Testing:** Thoroughly test new agents with various queries before deploying to production.

docs/getting-started/requirements.md

@@ -139,7 +139,7 @@ Prowler for M365 currently supports the following authentication types:
 ???+ warning
     For Prowler App only the Service Principal with User Credentials authentication method is supported.
 
-### Service Principal authentication
+### Service Principal authentication (recommended)
 
 Authentication flag: `--sp-env-auth`
 
@@ -154,9 +154,11 @@ export AZURE_TENANT_ID="XXXXXXXXX"
 If you try to execute Prowler with the `--sp-env-auth` flag and those variables are empty or not exported, the execution is going to fail.
 Follow the instructions in the [Create Prowler Service Principal](../tutorials/microsoft365/getting-started-m365.md#create-the-service-principal-app) section to create a service principal.
 
-With this credentials you will only be able to run the checks that work through MS Graph, this means that you won't run all the provider. If you want to scan all the checks from M365 you will need to use the recommended authentication method.
+If you don't add the external API permissions described in the mentioned section above you will only be able to run the checks that work through MS Graph. This means that you won't run all the provider.
 
-### Service Principal and User Credentials authentication (recommended)
+If you want to scan all the checks from M365 you will need to add the required permissions to the service principal application. Refer to the [Needed permissions](/docs/tutorials/microsoft365/getting-started-m365.md#needed-permissions) section for more information.
+
+### Service Principal and User Credentials authentication
 
 Authentication flag: `--env-auth`
 
@@ -170,9 +172,10 @@ export M365_USER="your_email@example.com"
 export M365_PASSWORD="examplepassword"
 ```
 
-These two new environment variables are **required** to execute the PowerShell modules needed to retrieve information from M365 services. Prowler uses Service Principal authentication to access Microsoft Graph and user credentials to authenticate to Microsoft PowerShell modules.
+These two new environment variables are **required** in this authentication method to execute the PowerShell modules needed to retrieve information from M365 services. Prowler uses Service Principal authentication to access Microsoft Graph and user credentials to authenticate to Microsoft PowerShell modules.
 
 - `M365_USER` should be your Microsoft account email using the **assigned domain in the tenant**. This means it must look like `example@YourCompany.onmicrosoft.com` or `example@YourCompany.com`, but it must be the exact domain assigned to that user in the tenant.
+
     ???+ warning
         If the user is newly created, you need to sign in with that account first, as Microsoft will prompt you to change the password. If you don’t complete this step, user authentication will fail because Microsoft marks the initial password as expired.
 
@@ -205,27 +208,56 @@ Since this is a delegated permission authentication method, necessary permission
 
 ### Needed permissions
 
-Prowler for M365 requires two types of permission scopes to be set (if you want to run the full provider including PowerShell checks). Both must be configured using Microsoft Entra ID:
+Prowler for M365 requires different permission scopes depending on the authentication method you choose. The permissions must be configured using Microsoft Entra ID:
 
-- **Service Principal Application Permissions**: These are set at the **application** level and are used to retrieve data from the identity being assessed:
-    - `AuditLog.Read.All`: Required for Entra service.
-    - `Directory.Read.All`: Required for all services.
-    - `Policy.Read.All`: Required for all services.
-    - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
-    - `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in.
+#### For Service Principal Authentication (`--sp-env-auth`) - Recommended
 
-    ???+ note
-        You can replace `Directory.Read.All` with `Domain.Read.All` is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
+When using service principal authentication, you need to add the following **Application Permissions** configured to:
 
-        > If you do this you will need to add also the `Organization.Read.All` permission to the service principal application in order to authenticate.
+**Microsoft Graph API Permissions:**
+- `AuditLog.Read.All`: Required for Entra service.
+- `Directory.Read.All`: Required for all services.
+- `Policy.Read.All`: Required for all services.
+- `SharePointTenantSettings.Read.All`: Required for SharePoint service.
+- `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in.
 
+**External API Permissions:**
+- `Exchange.ManageAsApp` from external API `Office 365 Exchange Online`: Required for Exchange PowerShell module app authentication. You also need to assign the `Exchange Administrator` role to the app.
+- `application_access` from external API `Skype and Teams Tenant Admin API`: Required for Teams PowerShell module app authentication.
 
+???+ note
+    You can replace `Directory.Read.All` with `Domain.Read.All` is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
 
-- **Powershell Modules Permissions**: These are set at the `M365_USER` level, so the user used to run Prowler must have one of the following roles:
-    - `Global Reader` (recommended): this allows you to read all roles needed.
-    - `Exchange Administrator` and `Teams Administrator`: user needs both roles but with this [roles](https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo#microsoft-365-permissions-in-exchange-online) you can access to the same information as a Global Reader (since only read access is needed, Global Reader is recommended).
+    > If you do this you will need to add also the `Organization.Read.All` permission to the service principal application in order to authenticate.
 
-In order to know how to assign those permissions and roles follow the instructions in the Microsoft Entra ID [permissions](../tutorials/microsoft365/getting-started-m365.md#grant-required-api-permissions) and [roles](../tutorials/microsoft365/getting-started-m365.md#assign-required-roles-to-your-user) section.
+???+ warning
+    With service principal only authentication, you can only run checks that work through MS Graph API. Some checks that require PowerShell modules will not be executed.
+
+#### For Service Principal + User Credentials Authentication (`--env-auth`)
+
+When using service principal with user credentials authentication, you need **both** sets of permissions:
+
+**1. Service Principal Application Permissions**:
+- You **will need** all the Microsoft Graph API permissions listed above.
+- You **won't need** the External API permissions listed above.
+
+**2. User-Level Permissions**: These are set at the `M365_USER` level, so the user used to run Prowler must have one of the following roles:
+- `Global Reader` (recommended): this allows you to read all roles needed.
+- `Exchange Administrator` and `Teams Administrator`: user needs both roles but with this [roles](https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo#microsoft-365-permissions-in-exchange-online) you can access to the same information as a Global Reader (since only read access is needed, Global Reader is recommended).
+
+???+ note
+    This is the **recommended authentication method** because it allows you to run the full M365 provider including PowerShell checks, providing complete coverage of all available security checks.
+
+#### For Browser Authentication (`--browser-auth`)
+
+When using browser authentication, permissions are delegated to the user, so the user must have the appropriate permissions rather than the application.
+
+???+ warning
+    With browser authentication, you will only be able to run checks that work through MS Graph API. PowerShell module checks will not be executed.
+
+---
+
+**To assign these permissions and roles**, follow the instructions in the Microsoft Entra ID [permissions](../tutorials/microsoft365/getting-started-m365.md#grant-required-api-permissions) and [roles](../tutorials/microsoft365/getting-started-m365.md#assign-required-roles-to-your-user) section.
 
 
 ### Supported PowerShell versions
@@ -439,6 +471,7 @@ The required modules are:
 
 - [ExchangeOnlineManagement](https://www.powershellgallery.com/packages/ExchangeOnlineManagement/3.6.0): Minimum version 3.6.0. Required for several checks across Exchange, Defender, and Purview.
 - [MicrosoftTeams](https://www.powershellgallery.com/packages/MicrosoftTeams/6.6.0): Minimum version 6.6.0. Required for all Teams checks.
+- [MSAL.PS](https://www.powershellgallery.com/packages/MSAL.PS/4.32.0): Required for Exchange module via application authentication.
 
 ## GitHub
 ### Authentication
@@ -455,3 +488,54 @@ The provided credentials must have the appropriate permissions to perform all th
 
 ???+ note
     GitHub App Credentials support less checks than other authentication methods.
+
+## Infrastructure as Code (IaC)
+
+Prowler's Infrastructure as Code (IaC) provider enables you to scan local infrastructure code for security and compliance issues using [Checkov](https://www.checkov.io/). This provider supports a wide range of IaC frameworks and requires no cloud authentication.
+
+### Authentication
+
+The IaC provider does not require any authentication or credentials since it scans local files directly. This makes it ideal for CI/CD pipelines and local development environments.
+
+### Supported Frameworks
+
+The IaC provider leverages Checkov to support multiple frameworks, including:
+
+- Terraform
+- CloudFormation
+- Kubernetes
+- ARM (Azure Resource Manager)
+- Serverless
+- Dockerfile
+- YAML/JSON (generic IaC)
+- Bicep
+- Helm
+- GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure Pipelines, CircleCI, Argo Workflows
+- Ansible
+- Kustomize
+- OpenAPI
+- SAST, SCA (Software Composition Analysis)
+
+### Usage
+
+To run Prowler with the IaC provider, use the `iac` flag. You can specify the directory to scan, frameworks to include, and paths to exclude.
+
+#### Basic Example
+
+```console
+prowler iac --scan-path ./my-iac-directory
+```
+
+#### Specify Frameworks
+
+Scan only Terraform and Kubernetes files:
+
+```console
+prowler iac --scan-path ./my-iac-directory --frameworks terraform kubernetes
+```
+
+#### Exclude Paths
+
+```console
+prowler iac --scan-path ./my-iac-directory --exclude-path ./my-iac-directory/test,./my-iac-directory/examples
+```

docs/index.md

@@ -572,12 +572,12 @@ With M365 you need to specify which auth method is going to be used:
 
 ```console
 
+# To use service principal authentication for MSGraph and PowerShell modules
+prowler m365 --sp-env-auth
+
 # To use both service principal (for MSGraph) and user credentials (for PowerShell modules)
 prowler m365 --env-auth
 
-# To use service principal authentication
-prowler m365 --sp-env-auth
-
 # To use az cli authentication
 prowler m365 --az-cli-auth
 
@@ -612,5 +612,27 @@ prowler github --github-app-id app_id --github-app-key app_key
       2. `OAUTH_APP_TOKEN`
       3. `GITHUB_APP_ID` and `GITHUB_APP_KEY`
 
+#### Infrastructure as Code (IaC)
+
+Prowler's Infrastructure as Code (IaC) provider enables you to scan local infrastructure code for security and compliance issues using [Checkov](https://www.checkov.io/). This provider supports a wide range of IaC frameworks, allowing you to assess your code before deployment.
+
+```console
+# Scan a directory for IaC files
+prowler iac --scan-path ./my-iac-directory
+
+# Specify frameworks to scan (default: all)
+prowler iac --scan-path ./my-iac-directory --frameworks terraform kubernetes
+
+# Exclude specific paths
+prowler iac --scan-path ./my-iac-directory --exclude-path ./my-iac-directory/test,./my-iac-directory/examples
+```
+
+???+ note
+    - The IaC provider does not require cloud authentication
+    - It is ideal for CI/CD pipelines and local development environments
+    - For more details on supported frameworks and rules, see the [Checkov documentation](https://www.checkov.io/1.Welcome/Quick%20Start.html)
+
+See more details about IaC scanning in the [IaC Tutorial](tutorials/iac/getting-started-iac.md) section.
+
 ## Prowler v2 Documentation
 For **Prowler v2 Documentation**, please check it out [here](https://github.com/prowler-cloud/prowler/blob/8818f47333a0c1c1a457453c87af0ea5b89a385f/README.md).

docs/tutorials/iac/getting-started-iac.md

@@ -0,0 +1,67 @@
+# Getting Started with the IaC Provider
+
+Prowler's Infrastructure as Code (IaC) provider enables you to scan local infrastructure code for security and compliance issues using [Checkov](https://www.checkov.io/). This provider supports a wide range of IaC frameworks, allowing you to assess your code before deployment.
+
+## Supported Frameworks
+
+The IaC provider leverages Checkov to support multiple frameworks, including:
+
+- Terraform
+- CloudFormation
+- Kubernetes
+- ARM (Azure Resource Manager)
+- Serverless
+- Dockerfile
+- YAML/JSON (generic IaC)
+- Bicep
+- Helm
+- GitHub Actions, GitLab CI, Bitbucket Pipelines, Azure Pipelines, CircleCI, Argo Workflows
+- Ansible
+- Kustomize
+- OpenAPI
+- SAST, SCA (Software Composition Analysis)
+
+## How It Works
+
+- The IaC provider scans your local directory (or a specified path) for supported IaC files.
+- No cloud credentials or authentication are required.
+- Mutelist logic is handled by Checkov, not Prowler.
+- Results are output in the same formats as other Prowler providers (CSV, JSON, HTML, etc.).
+
+## Usage
+
+To run Prowler with the IaC provider, use the `iac` argument. You can specify the directory to scan, frameworks to include, and paths to exclude.
+
+### Basic Example
+
+```sh
+prowler iac --scan-path ./my-iac-directory
+```
+
+### Specify Frameworks
+
+Scan only Terraform and Kubernetes files:
+
+```sh
+prowler iac --scan-path ./my-iac-directory --frameworks terraform kubernetes
+```
+
+### Exclude Paths
+
+```sh
+prowler iac --scan-path ./my-iac-directory --exclude-path ./my-iac-directory/test,./my-iac-directory/examples
+```
+
+## Output
+
+You can use the standard Prowler output options, for example:
+
+```sh
+prowler iac --scan-path ./iac --output-formats csv json html
+```
+
+## Notes
+
+- The IaC provider does not require cloud authentication.
+- It is ideal for CI/CD pipelines and local development environments.
+- For more details on supported frameworks and rules, see the [Checkov documentation](https://www.checkov.io/1.Welcome/Quick%20Start.html).

docs/tutorials/microsoft365/authentication.md

@@ -12,7 +12,7 @@ This allows Prowler to authenticate against Microsoft 365 using the following me
 To launch the tool first you need to specify which method is used through the following flags:
 
 ```console
-# To use service principal (app) authentication and Microsoft user credentials (to use PowerShell)
+# To use service principal (app) authentication and Microsoft user credentials
 prowler m365 --env-auth
 
 # To use service principal authentication
@@ -25,4 +25,4 @@ prowler m365 --az-cli-auth
 prowler m365 --browser-auth --tenant-id "XXXXXXXX"
 ```
 
-To use Prowler you need to set up also the permissions required to access your resources in your Microsoft 365 account, to more details refer to [Requirements](../../getting-started/requirements.md#microsoft-365)
+To use Prowler you need to set up also the permissions required to access your resources in your Microsoft 365 account, to more details refer to [Requirements](../../getting-started/requirements.md#needed-permissions-2)

docs/tutorials/microsoft365/getting-started-m365.md

@@ -30,7 +30,7 @@ Go to the Entra ID portal, then you can search for `Domain` or go to Identity >
 
 ![Custom Domain Names](./img/custom-domain-names.png)
 
-Once you are there just select the domain you want to use.
+Once you are there just select the domain you want to use as unique identifier for your M365 account in Prowler Cloud/App.
 
 ---
 
@@ -92,7 +92,7 @@ With this done you will have all the needed keys, summarized in the following ta
 
 ---
 
-### Grant required API permissions
+### Grant required Graph API permissions
 
 Assign the following Microsoft Graph permissions:
 
@@ -100,7 +100,7 @@ Assign the following Microsoft Graph permissions:
 - `Directory.Read.All`: Required for all services.
 - `Policy.Read.All`: Required for all services.
 - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
-- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in.
+- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in only if using user authentication.
 
 ???+ note
     You can replace `Directory.Read.All` with `Domain.Read.All` is a more restrictive permission but you won't be able to run the Entra checks related with DirectoryRoles and GetUsers.
@@ -128,18 +128,83 @@ Follow these steps to assign the permissions:
 
     ![Application Permissions](./img/app-permissions.png)
 
+---
 
-4. Click `+ Add a permission` > `Microsoft Graph` > `Delegated permissions`
 
-    ![Add API Permission](./img/add-delegated-api-permission.png)
+### Grant PowerShell modules permissions
 
-5. Search and select:
+The permissions you need to grant depends on whether you are using user credentials or service principal to authenticate to the M365 modules.
+
+???+ warning "Warning"
+    Make sure you add the correct set of permissions for the authentication method you are using.
+
+
+#### If using application(service principal) authentication (Recommended)
+
+To grant the permissions for the PowerShell modules via application authentication, you need to add the necessary APIs to your app registration.
+
+???+ warning "Warning"
+    You need to have a license that allows you to use the APIs.
+
+1. Add Exchange API:
+
+    - Search and select`Office 365 Exchange Online` API in **APIs my organization uses**.
+
+    ![Office 365 Exchange Online API](./img/search-exchange-api.png)
+
+    - Select `Exchange.ManageAsApp` permission and click on `Add permissions`.
+
+    ![Exchange.ManageAsApp Permission](./img/exchange-permission.png)
+
+    You also need to assign the `Exchange Administrator` role to the app. For that go to `Roles and administrators` and in the `Administrative roles` section click `here` to go to the directory level assignment:
+
+    ![Roles and administrators](./img/here.png)
+
+    Once in the directory level assignment, search for `Exchange Administrator` and click on it to open the assginments page of that role.
+
+    ![Exchange Administrator Role](./img/exchange-administrator-role.png)
+
+    Click on `Add assignments`, search for your app and click on `Assign`.
+
+    You have to select it as `Active` and click on `Assign` to assign the role to the app.
+
+    ![Assign Exchange Administrator Role](./img/assign-exchange-administrator-role.png)
+
+2. Add Teams API:
+
+    - Search and select `Skype and Teams Tenant Admin API` API in **APIs my organization uses**.
+
+    ![Skype and Teams Tenant Admin API](./img/search-skype-teams-tenant-admin-api.png)
+
+    - Select `application_access` permission and click on `Add permissions`.
+
+    ![application_access Permission](./img/teams-permission.png)
+
+3. Click on `Grant admin consent for <your-tenant-name>` to grant admin consent.
+
+    ![Grant Admin Consent](./img/grant-external-api-permissions.png)
+
+    The final result of permission assignment should be this:
+
+    ![Final Permission Assignment](./img/final-permissions.png)
+
+---
+
+#### If using user authentication
+
+This method is not recommended because it requires a user with MFA enabled and Microsoft will not allow MFA capable users to authenticate programmatically after 1st September 2025. See [Microsoft documentation](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet) for more information.
+
+???+ warning
+    Remember that if the user is newly created, you need to sign in with that account first, as Microsoft will prompt you to change the password. If you don’t complete this step, user authentication will fail because Microsoft marks the initial password as expired.
+
+
+1. Search and select:
 
     - `User.Read`
 
     ![Permission Screenshots](./img/directory-permission-delegated.png)
 
-6. After adding all the permissions, click on `Grant admin consent`
+2. Click `Add permissions`, then **grant admin consent**
 
     ![Grant Admin Consent](./img/grant-admin-consent.png)
 
@@ -147,37 +212,32 @@ Follow these steps to assign the permissions:
 
     ![Final Permission Assignment](./img/final-permissions-m365.png)
 
----
+3. Assign **required roles** to your **user**
 
-### Assign required roles to your user
+    Assign one of the following roles to your User:
 
-Assign one of the following roles to your User:
+    - `Global Reader` (recommended): this allows you to read all roles needed.
+    - `Exchange Administrator` and `Teams Administrator`: user needs both roles but with this [roles](https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo#microsoft-365-permissions-in-exchange-online) you can access to the same information as a Global Reader (here you only read so that's why we recomend that role).
 
-- `Global Reader` (recommended): this allows you to read all roles needed.
-- `Exchange Administrator` and `Teams Administrator`: user needs both roles but with this [roles](https://learn.microsoft.com/en-us/exchange/permissions-exo/permissions-exo#microsoft-365-permissions-in-exchange-online) you can access to the same information as a Global Reader (here you only read so that's why we recomend that role).
+    Follow these steps to assign the role:
 
-Follow these steps to assign the role:
+    1. Go to Users > All Users > Click on the email for the user you will use
 
-1. Go to Users > All Users > Click on the email for the user you will use
+        ![User Overview](./img/user-info-page.png)
 
-    ![User Overview](./img/user-info-page.png)
+    2. Click `Assigned Roles`
 
-2. Click `Assigned Roles`
+        ![User Roles](./img/user-role-page.png)
 
-    ![User Roles](./img/user-role-page.png)
+    3. Click on `Add assignments`, then search and select:
 
-3. Click on `Add assignments`, then search and select:
+        - `Global Reader` This is the recommended, if you want to use the others just search for them
 
-    - `Global Reader` This is the recommended, if you want to use the others just search for them
+        ![Global Reader Screenshots](./img/global-reader.png)
 
-    ![Global Reader Screenshots](./img/global-reader.png)
+    4. Click on next, then assign the role as `Active`, and click on `Assign` to grant admin consent
 
-4. Click on next, then assign the role as `Active`, and click on `Assign` to grant admin consent
-
-    ![Grant Admin Consent for Role](./img/grant-admin-consent-for-role.png)
-
-???+ warning
-    Remember that if the user is newly created, you need to sign in with that account first, as Microsoft will prompt you to change the password. If you don’t complete this step, user authentication will fail because Microsoft marks the initial password as expired.
+        ![Grant Admin Consent for Role](./img/grant-admin-consent-for-role.png)
 
 ---
 
@@ -193,6 +253,8 @@ Follow these steps to assign the role:
     - `Client ID`
     - `Tenant ID`
     - `AZURE_CLIENT_SECRET` from earlier
+
+    If you are using user authentication, also add:
     - `M365_USER` the user using the correct assigned domain, more info [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended)
     - `M365_PASSWORD` the password of the user
 

docs/tutorials/prowler-app-lighthouse.md

@@ -0,0 +1,204 @@
+# Prowler Lighthouse
+
+Prowler Lighthouse is an AI Cloud Security Analyst chatbot that helps you understand, prioritize, and remediate security findings in your cloud environments. It's designed to provide security expertise for teams without dedicated resources, acting as your 24/7 virtual cloud security analyst.
+
+<img src="../img/lighthouse-intro.png" alt="Prowler Lighthouse">
+
+## How It Works
+
+Prowler Lighthouse uses OpenAI's language models and integrates with your Prowler security findings data.
+
+Here's what's happening behind the scenes:
+
+- The system uses a multi-agent architecture built with [LanggraphJS](https://github.com/langchain-ai/langgraphjs) for LLM logic and [Vercel AI SDK UI](https://sdk.vercel.ai/docs/ai-sdk-ui/overview) for frontend chatbot.
+- It uses a ["supervisor" architecture](https://langchain-ai.lang.chat/langgraphjs/tutorials/multi_agent/agent_supervisor/) that interacts with different agents for specialized tasks. For example, `findings_agent` can analyze detected security findings, while `overview_agent` provides a summary of connected cloud accounts.
+- The system connects to OpenAI models to understand, fetch the right data, and respond to the user's query.
+???+ note
+    Lighthouse is tested against `gpt-4o` and `gpt-4o-mini` OpenAI models.
+- The supervisor agent is the main contact point. It is what users interact with directly from the chat interface. It coordinates with other agents to answer users' questions comprehensively.
+
+<img src="../img/lighthouse-architecture.png" alt="Lighthouse Architecture">
+
+???+ note
+    All agents can only read relevant security data. They cannot modify your data or access sensitive information like configured secrets or tenant details.
+
+## Set up
+
+Getting started with Prowler Lighthouse is easy:
+
+1. Go to the configuration page in your Prowler dashboard.
+2. Enter your OpenAI API key.
+3. Select your preferred model. The recommended one for best results is `gpt-4o`.
+4. (Optional) Add business context to improve response quality and prioritization.
+
+<img src="../img/lighthouse-config.png" alt="Lighthouse Configuration">
+
+### Adding Business Context
+
+The optional business context field lets you provide additional information to help Lighthouse understand your environment and priorities, including:
+
+- Your organization's cloud security goals
+- Information about account owners or responsible teams
+- Compliance requirements for your organization
+- Current security initiatives or focus areas
+
+Better context leads to more relevant responses and prioritization that aligns with your needs.
+
+## Capabilities
+
+Prowler Lighthouse is designed to be your AI security team member, with capabilities including:
+
+### Natural Language Querying
+
+Ask questions in plain English about your security findings. Examples:
+
+- "What are my highest risk findings?"
+- "Show me all S3 buckets with public access."
+- "What security issues were found in my production accounts?"
+
+<img src="../img/lighthouse-feature1.png" alt="Natural language querying">
+
+### Detailed Remediation Guidance
+
+Get tailored step-by-step instructions for fixing security issues:
+
+- Clear explanations of the problem and its impact
+- Commands or console steps to implement fixes
+- Alternative approaches with different solutions
+
+<img src="../img/lighthouse-feature2.png" alt="Detailed Remediation">
+
+### Enhanced Context and Analysis
+
+Lighthouse can provide additional context to help you understand the findings:
+
+- Explain security concepts related to findings in simple terms
+- Provide risk assessments based on your environment and context
+- Connect related findings to show broader security patterns
+
+<img src="../img/lighthouse-config.png" alt="Business Context">
+
+<img src="../img/lighthouse-feature3.png" alt="Contextual Responses">
+
+## Important Notes
+
+Prowler Lighthouse is powerful, but there are limitations:
+
+- **Continuous improvement**: Please report any issues, as the feature may make mistakes or encounter errors, despite extensive testing.
+- **Access limitations**: Lighthouse can only access data the logged-in user can view. If you can't see certain information, Lighthouse can't see it either.
+- **NextJS session dependence**: If your Prowler application session expires or logs out, Lighthouse will error out. Refresh and log back in to continue.
+- **Response quality**: The response quality depends on the selected OpenAI model. For best results, use gpt-4o.
+
+### Getting Help
+
+If you encounter issues with Prowler Lighthouse or have suggestions for improvements, please [reach out through our Slack channel](https://goto.prowler.com/slack).
+
+### What Data Is Shared to OpenAI?
+
+The following API endpoints are accessible to Prowler Lighthouse. Data from the following API endpoints could be shared with OpenAI depending on the scope of user's query:
+
+#### Accessible API Endpoints
+
+**User Management:**
+
+- List all users - `/api/v1/users`
+- Retrieve the current user's information - `/api/v1/users/me`
+
+**Provider Management:**
+
+- List all providers - `/api/v1/providers`
+- Retrieve data from a provider - `/api/v1/providers/{id}`
+
+**Scan Management:**
+
+- List all scans - `/api/v1/scans`
+- Retrieve data from a specific scan - `/api/v1/scans/{id}`
+
+**Resource Management:**
+
+- List all resources - `/api/v1/resources`
+- Retrieve data for a resource - `/api/v1/resources/{id}`
+
+**Findings Management:**
+
+- List all findings - `/api/v1/findings`
+- Retrieve data from a specific finding - `/api/v1/findings/{id}`
+- Retrieve metadata values from findings - `/api/v1/findings/metadata`
+
+**Overview Data:**
+
+- Get aggregated findings data - `/api/v1/overviews/findings`
+- Get findings data by severity - `/api/v1/overviews/findings_severity`
+- Get aggregated provider data - `/api/v1/overviews/providers`
+- Get findings data by service - `/api/v1/overviews/services`
+
+**Compliance Management:**
+
+- List compliance overviews for a scan - `/api/v1/compliance-overviews`
+- Retrieve data from a specific compliance overview - `/api/v1/compliance-overviews/{id}`
+
+#### Excluded API Endpoints
+
+Not all Prowler API endpoints are integrated with Lighthouse. They are intentionally excluded for the following reasons:
+
+- OpenAI/other LLM providers shouldn't have access to sensitive data (like fetching provider secrets and other sensitive config)
+- Users queries don't need responses from those API endpoints (ex: tasks, tenant details, downloading zip file, etc.)
+
+**Excluded Endpoints:**
+
+**User Management:**
+
+- List specific users information - `/api/v1/users/{id}`
+- List user memberships - `/api/v1/users/{user_pk}/memberships`
+- Retrieve membership data from the user - `/api/v1/users/{user_pk}/memberships/{id}`
+
+**Tenant Management:**
+
+- List all tenants - `/api/v1/tenants`
+- Retrieve data from a tenant - `/api/v1/tenants/{id}`
+- List tenant memberships - `/api/v1/tenants/{tenant_pk}/memberships`
+- List all invitations - `/api/v1/tenants/invitations`
+- Retrieve data from tenant invitation - `/api/v1/tenants/invitations/{id}`
+
+**Security and Configuration:**
+
+- List all secrets - `/api/v1/providers/secrets`
+- Retrieve data from a secret - `/api/v1/providers/secrets/{id}`
+- List all provider groups - `/api/v1/provider-groups`
+- Retrieve data from a provider group - `/api/v1/provider-groups/{id}`
+
+**Reports and Tasks:**
+
+- Download zip report - `/api/v1/scans/{v1}/report`
+- List all tasks - `/api/v1/tasks`
+- Retrieve data from a specific task - `/api/v1/tasks/{id}`
+
+**Lighthouse Configuration:**
+
+- List OpenAI configuration - `/api/v1/lighthouse-config`
+- Retrieve OpenAI key and configuration - `/api/v1/lighthouse-config/{id}`
+
+???+ note
+    Agents only have access to hit GET endpoints. They don't have access to other HTTP methods.
+
+## FAQs
+
+**1. Why only OpenAI models?**
+
+During feature development, we evaluated other LLM models.
+
+- **Claude AI** - Claude models have [tier-based ratelimits](https://docs.anthropic.com/en/api/rate-limits#requirements-to-advance-tier). For Lighthouse to answer slightly complex questions, there are a handful of API calls to the LLM provider within few seconds. With Claude's tiering system, users must purchase $400 credits or convert their subscription to monthly invoicing after talking to their sales team. This pricing may not suit all Prowler users.
+- **Gemini Models** - Gemini lacks a solid tool calling feature like OpenAI. It calls functions recursively until exceeding limits. Gemini-2.5-Pro-Experimental is better than previous models regarding tool calling and responding, but it's still experimental.
+- **Deepseek V3** - Doesn't support system prompt messages.
+
+**2. Why a multi-agent supervisor model?**
+
+Context windows are limited. While demo data fits inside the context window, querying real-world data often exceeds it. A multi-agent architecture is used so different agents fetch different sizes of data and respond with the minimum required data to the supervisor. This spreads the context window usage across agents.
+
+**3. Is my security data shared with OpenAI?**
+
+Minimal data is shared to generate useful responses. Agents can access security findings and remediation details when needed. Provider secrets are protected by design and cannot be read. The Lighthouse key is only accessible to our NextJS server and is never sent to LLMs. Resource metadata (names, tags, account/project IDs, etc) may be shared with OpenAI based on your query requirements.
+
+**4. Can the Lighthouse change my cloud environment?**
+
+No. The agent doesn't have the tools to make the changes, even if the configured cloud provider API keys contain permissions to modify resources.

docs/tutorials/prowler-app-sso.md

@@ -1,6 +1,6 @@
 # Configuring SAML Single Sign-On (SSO) in Prowler
 
-This guide explains how to enable and test SAML SSO integration in Prowler. It includes environment setup, certificate configuration, API endpoints, and how to configure Okta as your Identity Provider (IdP).
+This guide explains how to enable and test SAML SSO integration in Prowler. It includes environment setup, API endpoints, and how to configure Okta as your Identity Provider (IdP).
 
 ---
 
@@ -20,26 +20,6 @@ Update this variable to specify which domains Django should accept incoming requ
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,prowler-api,mycompany.prowler
 ```
 
-# SAML Certificates
-
-To enable SAML support, you must provide a public certificate and private key to allow Prowler to sign SAML requests and validate responses.
-
-### Why is this necessary?
-
-SAML relies on digital signatures to verify trust between the Identity Provider (IdP) and the Service Provider (SP). Prowler acts as the SP and must use a certificate to sign outbound authentication requests.
-
-### Add to your .env file:
-
-```env
-SAML_PUBLIC_CERT="-----BEGIN CERTIFICATE-----
-...your certificate here...
------END CERTIFICATE-----"
-
-SAML_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----
-...your private key here...
------END PRIVATE KEY-----"
-```
-
 # SAML Configuration API
 
 You can manage SAML settings via the API. Prowler provides full CRUD support for tenant-specific SAML configuration.
@@ -60,7 +40,7 @@ You can manage SAML settings via the API. Prowler provides full CRUD support for
 
 ### Description
 
-This endpoint receives an email and checks if there is an active SAML configuration for the associated domain (i.e., the part after the @). If a configuration exists and the required certificates are present, it responds with an HTTP 302 redirect to the appropriate saml_login endpoint for the organization.
+This endpoint receives an email and checks if there is an active SAML configuration for the associated domain (i.e., the part after the @). If a configuration exists it responds with an HTTP 302 redirect to the appropriate saml_login endpoint for the organization.
 
 - POST /api/v1/accounts/saml/initiate/
 
@@ -78,7 +58,7 @@ This endpoint receives an email and checks if there is an active SAML configurat
 
 	•	302 FOUND: Redirects to the SAML login URL associated with the organization.
 
-	•	403 FORBIDDEN: The domain is not authorized or SAML certificates are missing from the configuration.
+	•	403 FORBIDDEN: The domain is not authorized.
 
 ### Validation logic
 
@@ -86,8 +66,6 @@ This endpoint receives an email and checks if there is an active SAML configurat
 
 	•	Retrieves the related SAMLConfiguration object via tenant_id.
 
-	•	Verifies that SAML_PUBLIC_CERT and SAML_PRIVATE_KEY environment variables are set.
-
 
 # SAML Integration: Testing Guide
 
@@ -95,41 +73,22 @@ This document outlines the process for testing the SAML integration functionalit
 
 ---
 
-## 1. Generate Self-Signed Certificate and Private Key
-
-First, generate a self-signed certificate and corresponding private key using OpenSSL:
-
-```bash
-openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
-  -keyout saml_private_key.pem \
-  -out saml_public_cert.pem \
-  -subj "/C=US/ST=Test/L=Test/O=Test/OU=Test/CN=localhost"
-```
-
-## 2. Add Certificate Values to .env
-
-Paste the generated values into your .env file:
-```
-SAML_PUBLIC_CERT=<paste certificate content here>
-SAML_PRIVATE_KEY=<paste private key content here>
-```
-
-## 3. Start Ngrok and Update ALLOWED_HOSTS
+## 1. Start Ngrok and Update ALLOWED_HOSTS
 
 Start ngrok on port 8080:
 ```
 ngrok http 8080
 ```
 
-Then, copy the generated ngrok URL and include it in the ALLOWED_HOSTS setting. If you’re using the development environment, it usually defaults to *, but in some cases this may not work properly, like in my tests (investigate):
+Then, copy the generated ngrok URL and include it in the ALLOWED_HOSTS setting. If you're using the development environment, it usually defaults to *, but in some cases this may not work properly, like in my tests (investigate):
 
 ```
 ALLOWED_HOSTS = env.list("DJANGO_ALLOWED_HOSTS", default=["*"])
 ```
 
-## 4. Configure the Identity Provider (IdP)
+## 2. Configure the Identity Provider (IdP)
 
-Start your environment and configure your IdP. You will need to download the IdP’s metadata XML file.
+Start your environment and configure your IdP. You will need to download the IdP's metadata XML file.
 
 Your Assertion Consumer Service (ACS) URL must follow this format:
 
@@ -137,7 +96,7 @@ Your Assertion Consumer Service (ACS) URL must follow this format:
 https://<PROXY_URL>/api/v1/accounts/saml/<CONFIGURED_DOMAIN>/acs/
 ```
 
-## 5. IdP Attribute Mapping
+## 3. IdP Attribute Mapping
 
 The following fields are expected from the IdP:
 
@@ -147,11 +106,11 @@ The following fields are expected from the IdP:
 
 - userType (this is the name of the role the user should be assigned)
 
-- companyName (this is filled automatically if the IdP includes an “organization” field)
+- companyName (this is filled automatically if the IdP includes an "organization" field)
 
 These values are dynamic. If the values change in the IdP, they will be updated on the next login.
 
-## 6. SAML Configuration API (POST)
+## 4. SAML Configuration API (POST)
 
 SAML configuration is managed via a CRUD API. Use the following POST request to create a new configuration:
 
@@ -171,7 +130,37 @@ curl --location 'http://localhost:8080/api/v1/saml-config' \
 }'
 ```
 
-## 7. Start SAML Login Flow
+## 5. SAML SSO Callback Configuration
+
+### Environment Variable Configuration
+
+The SAML authentication flow requires proper callback URL configuration to handle post-authentication redirects. Configure the following environment variables:
+
+#### `SAML_SSO_CALLBACK_URL`
+
+Specifies the callback endpoint that will be invoked upon successful SAML authentication completion. This URL directs users back to the web application interface.
+
+```env
+SAML_SSO_CALLBACK_URL="${AUTH_URL}/api/auth/callback/saml"
+```
+
+#### `AUTH_URL`
+
+Defines the base URL of the web user interface application that serves as the authentication callback destination.
+
+```env
+AUTH_URL="<WEB_UI_URL>"
+```
+
+### Configuration Notes
+
+- The `SAML_SSO_CALLBACK_URL` dynamically references the `AUTH_URL` variable to construct the complete callback endpoint
+- Ensure the `AUTH_URL` points to the correct web UI deployment (development, staging, or production)
+- The callback endpoint `/api/auth/callback/saml` must be accessible and properly configured to handle SAML authentication responses
+- Both environment variables are required for proper SAML SSO functionality
+- Verify that the `NEXT_PUBLIC_API_BASE_URL` environment variable is properly configured to reference the correct API server base URL corresponding to your target deployment environment. This ensures proper routing of SAML callback requests to the appropriate backend services.
+
+## 6. Start SAML Login Flow
 
 Once everything is configured, start the SAML login process by visiting the following URL:
 
@@ -181,6 +170,6 @@ https://<PROXY_IP>/api/v1/accounts/saml/<CONFIGURED_DOMAIN>/login/?email=<USER_E
 
 At the end you will get a valid access and refresh token
 
-## 8. Notes on the initiate Endpoint
+## 7. Notes on the initiate Endpoint
 
-The initiate endpoint is not strictly required. It was created to allow extra checks or behavior modifications (like enumeration mitigation). It also simplifies UI integration with SAML, but again, it’s optional.
+The initiate endpoint is not strictly required. It was created to allow extra checks or behavior modifications (like enumeration mitigation). It also simplifies UI integration with SAML, but again, it's optional.

docs/tutorials/prowler-app.md

@@ -101,7 +101,26 @@ For Azure, Prowler App uses a service principal application to authenticate, for
 
 ---
 ### **Step 4.3: GCP Credentials**
-To connect your GCP Project, you need to use the Application Default Credentials (ADC) returned by the `gcloud` CLI. Here’s how to set up:
+
+For Google Cloud, first enter your `GCP Project ID` and then select the authentication method you want to use:
+
+- **Service Account Authentication** (**Recommended**)
+- **Application Default Credentials**
+
+**Service Account Authentication** is the recommended authentication method for automated systems and machine-to-machine interactions, like Prowler. For detailed information about this, refer to the [Google Cloud documentation](https://cloud.google.com/iam/docs/service-account-overview).
+
+<img src="../img/gcp-auth-methods.png" alt="GCP Authentication Methods" width="700"/>
+
+#### **Step 4.3.1: Service Account Authentication**
+
+First of all, in the same project that you selected in the previous step, you need to create a service account and then generate a key in JSON format for it. For more information about this, you can follow the next Google Cloud documentation tutorials:
+
+- [Create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts)
+- [Generate a key for a service account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
+
+<img src="../img/gcp-service-account-creds.png" alt="GCP Service Account Credentials" width="700"/>
+
+#### **Step 4.3.2: Application Default Credentials**
 
 1. Run the following command in your terminal to authenticate with GCP:
 ```bash
@@ -151,7 +170,15 @@ By default, the `kubeconfig` file is located at `~/.kube/config`.
 ---
 
 ### **Step 4.5: M365 Credentials**
-For M365, Prowler App uses a service principal application with user and password to authenticate, for more information about the requirements needed for this provider check this [section](../getting-started/requirements.md#microsoft-365). Also, the detailed steps of how to add this provider to Prowler Cloud and start using it are [here](./microsoft365/getting-started-m365.md).
+For M365, you must enter your Domain ID and choose the authentication method you want to use:
+
+- Service Principal Authentication (Recommended)
+- User Authentication (only works if the user does not have MFA enabled)
+
+???+ note
+    User authentication with M365_USER and M365_PASSWORD is optional and will only work if the account does not enforce MFA.
+
+For full setup instructions and requirements, check the [Microsoft 365 provider requirements](./microsoft365/getting-started-m365.md).
 
 <img src="../../img/m365-credentials.png" alt="Prowler Cloud M365 Credentials" width="700"/>
 

mkdocs.yml

@@ -54,6 +54,7 @@ nav:
           - Role-Based Access Control: tutorials/prowler-app-rbac.md
           - Social Login: tutorials/prowler-app-social-login.md
           - SSO with SAML: tutorials/prowler-app-sso.md
+          - Lighthouse: tutorials/prowler-app-lighthouse.md
       - CLI:
           - Miscellaneous: tutorials/misc.md
           - Reporting: tutorials/reporting.md
@@ -106,6 +107,8 @@ nav:
           - Getting Started: tutorials/microsoft365/getting-started-m365.md
           - Authentication: tutorials/microsoft365/authentication.md
           - Use of PowerShell: tutorials/microsoft365/use-of-powershell.md
+      - IaC:
+          - Getting Started: tutorials/iac/getting-started-iac.md
   - Developer Guide:
       - General Concepts:
         - Introduction: developer-guide/introduction.md
@@ -115,6 +118,7 @@ nav:
         - Outputs: developer-guide/outputs.md
         - Integrations: developer-guide/integrations.md
         - Compliance: developer-guide/security-compliance-framework.md
+        - Lighthouse: developer-guide/lighthouse.md
       - Provider Specific Details:
         - AWS: developer-guide/aws-details.md
         - Azure: developer-guide/azure-details.md
@@ -128,6 +132,7 @@ nav:
           - Unit Tests: developer-guide/unit-testing.md
           - Integration Tests: developer-guide/integration-testing.md
         - Debugging: developer-guide/debugging.md
+        - Configurable Checks: developer-guide/configurable-checks.md
   - Security: security.md
   - Contact Us: contact.md
   - Troubleshooting: troubleshooting.md

prowler/CHANGELOG.md

@@ -2,18 +2,42 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
-## [v5.8.0] (Prowler UNRELEASED)
+## [v5.9.0] (Prowler UNRELEASED)
 
 ### Added
-- Add `storage_geo_redundant_enabled` check for Azure provider. [(#7980)](https://github.com/prowler-cloud/prowler/pull/7980)
-- Add `storage_cross_tenant_replication_disabled` check for Azure provider. [(#7977)](https://github.com/prowler-cloud/prowler/pull/7977)
+- `storage_smb_channel_encryption_with_secure_algorithm` check for Azure provider [(#8123)](https://github.com/prowler-cloud/prowler/pull/8123)
+- `vm_backup_enabled` check for Azure provider [(#8182)](https://github.com/prowler-cloud/prowler/pull/8182)
+- `vm_linux_enforce_ssh_authentication` check for Azure provider [(#8149)](https://github.com/prowler-cloud/prowler/pull/8149)
+- `vm_ensure_using_approved_images` check for Azure provider [(#8168)](https://github.com/prowler-cloud/prowler/pull/8168)
+- `vm_scaleset_associated_load_balancer` check for Azure provider [(#8181)](https://github.com/prowler-cloud/prowler/pull/8181)
+
+### Changed
+
+### Fixed
+
+---
+
+## [v5.8.1] (Prowler 5.8.1)
+
+### Fixed
+- fix(iam): detect wildcarded ARNs in sts:AssumeRole policy resources [(#8164)](https://github.com/prowler-cloud/prowler/pull/8164)
+- fix(ec2): allow empty values for http_endpoint in templates [(#8184)](https://github.com/prowler-cloud/prowler/pull/8184)
+
+---
+
+## [v5.8.0] (Prowler v5.8.0)
+
+### Added
+
+- `storage_geo_redundant_enabled` check for Azure provider [(#7980)](https://github.com/prowler-cloud/prowler/pull/7980)
+- `storage_cross_tenant_replication_disabled` check for Azure provider [(#7977)](https://github.com/prowler-cloud/prowler/pull/7977)
 - CIS 1.11 compliance framework for Kubernetes [(#7790)](https://github.com/prowler-cloud/prowler/pull/7790)
 - Support `HTTPS_PROXY` and `K8S_SKIP_TLS_VERIFY` in Kubernetes [(#7720)](https://github.com/prowler-cloud/prowler/pull/7720)
 - Weight for Prowler ThreatScore scoring [(#7795)](https://github.com/prowler-cloud/prowler/pull/7795)
-- New check `entra_users_mfa_capable` for M365 provider [(#7734)](https://github.com/prowler-cloud/prowler/pull/7734)
-- New check `admincenter_organization_customer_lockbox_enabled` for M365 provider [(#7732)](https://github.com/prowler-cloud/prowler/pull/7732)
-- New check `admincenter_external_calendar_sharing_disabled` for M365 provider [(#7733)](https://github.com/prowler-cloud/prowler/pull/7733)
-- a level for Prowler ThreatScore in the accordion in Dashboard [(#7739)](https://github.com/prowler-cloud/prowler/pull/7739)
+- `entra_users_mfa_capable` check for M365 provider [(#7734)](https://github.com/prowler-cloud/prowler/pull/7734)
+- `admincenter_organization_customer_lockbox_enabled` check for M365 provider [(#7732)](https://github.com/prowler-cloud/prowler/pull/7732)
+- `admincenter_external_calendar_sharing_disabled` check for M365 provider [(#7733)](https://github.com/prowler-cloud/prowler/pull/7733)
+- Level for Prowler ThreatScore in the accordion in Dashboard [(#7739)](https://github.com/prowler-cloud/prowler/pull/7739)
 - CIS 4.0 compliance framework for GCP [(7785)](https://github.com/prowler-cloud/prowler/pull/7785)
 - `repository_has_codeowners_file` check for GitHub provider [(#7752)](https://github.com/prowler-cloud/prowler/pull/7752)
 - `repository_default_branch_requires_signed_commits` check for GitHub provider [(#7777)](https://github.com/prowler-cloud/prowler/pull/7777)
@@ -31,31 +55,35 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Avoid bypassing IAM check using wildcards [(#7708)](https://github.com/prowler-cloud/prowler/pull/7708)
 - `storage_blob_versioning_is_enabled` new check for Azure provider [(#7927)](https://github.com/prowler-cloud/prowler/pull/7927)
 - New method to authenticate in AppInsights in check `app_function_application_insights_enabled` [(#7763)](https://github.com/prowler-cloud/prowler/pull/7763)
-- ISO 27001 2022 for M365 provider. [(#7985)](https://github.com/prowler-cloud/prowler/pull/7985)
+- ISO 27001 2022 for M365 provider [(#7985)](https://github.com/prowler-cloud/prowler/pull/7985)
 - `codebuild_project_uses_allowed_github_organizations` check for AWS provider [(#7595)](https://github.com/prowler-cloud/prowler/pull/7595)
 - IaC provider [(#7852)](https://github.com/prowler-cloud/prowler/pull/7852)
 - Azure Databricks service integration for Azure provider, including the `databricks_workspace_vnet_injection_enabled` check [(#8008)](https://github.com/prowler-cloud/prowler/pull/8008)
-- Azure Databricks check `databricks_workspace_cmk_encryption_enabled` to ensure workspaces use customer-managed keys (CMK) for encryption at rest [(#8017)](https://github.com/prowler-cloud/prowler/pull/8017)
-- Add `storage_account_default_to_entra_authorization_enabled` check for Azure provider. [(#7981)](https://github.com/prowler-cloud/prowler/pull/7981)
-- `keyvault_ensure_public_network_access_disabled` check for Azure provider. [(#8072)](https://github.com/prowler-cloud/prowler/pull/8072)
-- New check `monitor_alert_service_health_exists` for Azure provider [(#8067)](https://github.com/prowler-cloud/prowler/pull/8067)
+- `databricks_workspace_cmk_encryption_enabled` check for Azure provider [(#8017)](https://github.com/prowler-cloud/prowler/pull/8017)
+- Appication auth for PowerShell in M365 provider [(#7992)](https://github.com/prowler-cloud/prowler/pull/7992)
+- `storage_account_default_to_entra_authorization_enabled` check for Azure provider [(#7981)](https://github.com/prowler-cloud/prowler/pull/7981)
+- Improve overview page from Prowler Dashboard [(#8118)](https://github.com/prowler-cloud/prowler/pull/8118)
+- `keyvault_ensure_public_network_access_disabled` check for Azure provider [(#8072)](https://github.com/prowler-cloud/prowler/pull/8072)
+- `monitor_alert_service_health_exists` check for Azure provider [(#8067)](https://github.com/prowler-cloud/prowler/pull/8067)
 - Replace `Domain.Read.All` with `Directory.Read.All` in Azure and M365 docs [(#8075)](https://github.com/prowler-cloud/prowler/pull/8075)
 - Refactor IaC provider to use Checkov as Python library [(#8093)](https://github.com/prowler-cloud/prowler/pull/8093)
+- New check `codebuild_project_not_publicly_accessible` for AWS provider [(#8127)](https://github.com/prowler-cloud/prowler/pull/8127)
 
 ### Fixed
 - Consolidate Azure Storage file service properties to the account level, improving the accuracy of the `storage_ensure_file_shares_soft_delete_is_enabled` check [(#8087)](https://github.com/prowler-cloud/prowler/pull/8087)
-
-### Removed
-- OCSF version number references to point always to the latest [(#8064)](https://github.com/prowler-cloud/prowler/pull/8064)
-
----
-
-## [v5.7.6] (Prowler UNRELEASED)
-
-### Fixed
+- Migrate Azure VM service and managed disk logic to Pydantic models for better serialization and type safety, and update all related tests to use the new models and fix UUID handling [(#https://github.com/prowler-cloud/prowler/pull/8151)](https://github.com/prowler-cloud/prowler/pull/https://github.com/prowler-cloud/prowler/pull/8151)
 - `organizations_scp_check_deny_regions` check to pass when SCP policies have no statements [(#8091)](https://github.com/prowler-cloud/prowler/pull/8091)
 - Fix logic in VPC and ELBv2 checks [(#8077)](https://github.com/prowler-cloud/prowler/pull/8077)
 - Retrieve correctly ECS Container insights settings [(#8097)](https://github.com/prowler-cloud/prowler/pull/8097)
+- Fix correct handling for different accounts-dates in prowler dashboard compliance page [(#8108)](https://github.com/prowler-cloud/prowler/pull/8108)
+- Handling of `block-project-ssh-keys` in GCP check `compute_instance_block_project_wide_ssh_keys_disabled` [(#8115)](https://github.com/prowler-cloud/prowler/pull/8115)
+- Handle empty name in Azure Defender and GCP checks [(#8120)](https://github.com/prowler-cloud/prowler/pull/8120)
+
+### Changed
+- Reworked `S3.test_connection` to match the AwsProvider logic [(#8088)](https://github.com/prowler-cloud/prowler/pull/8088)
+
+### Removed
+- OCSF version number references to point always to the latest [(#8064)](https://github.com/prowler-cloud/prowler/pull/8064)
 
 ---
 
@@ -63,7 +91,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### Fixed
 - Use unified timestamp for all requirements [(#8059)](https://github.com/prowler-cloud/prowler/pull/8059)
-- Add EKS to service without subservices. [(#7959)](https://github.com/prowler-cloud/prowler/pull/7959)
+- Add EKS to service without subservices [(#7959)](https://github.com/prowler-cloud/prowler/pull/7959)
 - `apiserver_strong_ciphers_only` check for K8S provider [(#7952)](https://github.com/prowler-cloud/prowler/pull/7952)
 - Handle `0` at the start and end of account uids in Prowler Dashboard [(#7955)](https://github.com/prowler-cloud/prowler/pull/7955)
 - Typo in PCI 4.0 for K8S provider [(#7971)](https://github.com/prowler-cloud/prowler/pull/7971)

prowler/config/config.py

@@ -12,7 +12,7 @@ from prowler.lib.logger import logger
 
 timestamp = datetime.today()
 timestamp_utc = datetime.now(timezone.utc).replace(tzinfo=timezone.utc)
-prowler_version = "5.8.0"
+prowler_version = "5.9.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://prowler.com/wp-content/uploads/logo-html.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"

prowler/lib/check/models.py

@@ -522,7 +522,11 @@ class Check_Report_GCP(Check_Report):
             or getattr(resource, "name", None)
             or ""
         )
-        self.resource_name = resource_name or getattr(resource, "name", "")
+        self.resource_name = (
+            resource_name
+            or getattr(resource, "name", "")
+            or getattr(resource, "id", "")
+        )
         self.project_id = project_id or getattr(resource, "project_id", "")
         self.location = (
             location

prowler/providers/aws/aws_regions_by_service.json

@@ -951,6 +951,7 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
+          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -1336,7 +1337,9 @@
         "aws": [
           "us-east-1"
         ],
-        "aws-cn": [],
+        "aws-cn": [
+          "cn-northwest-1"
+        ],
         "aws-us-gov": []
       }
     },
@@ -1982,6 +1985,7 @@
           "eu-central-2",
           "eu-north-1",
           "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
@@ -2785,6 +2789,9 @@
       "regions": {
         "aws": [
           "af-south-1",
+          "ap-northeast-1",
+          "ap-northeast-2",
+          "ap-southeast-1",
           "ap-southeast-2",
           "ca-central-1",
           "eu-central-1",
@@ -3461,6 +3468,7 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
+          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -3506,6 +3514,7 @@
       "regions": {
         "aws": [
           "ap-northeast-1",
+          "ap-northeast-2",
           "ap-northeast-3",
           "eu-west-1",
           "eu-west-2",
@@ -4987,6 +4996,8 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
+          "ap-southeast-5",
+          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
@@ -5469,25 +5480,37 @@
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
+          "ap-southeast-4",
+          "ap-southeast-5",
+          "ap-southeast-7",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
           "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "il-central-1",
+          "me-central-1",
           "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-1",
           "us-west-2"
         ],
-        "aws-cn": [],
+        "aws-cn": [
+          "cn-north-1",
+          "cn-northwest-1"
+        ],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -5503,18 +5526,27 @@
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
+          "ap-southeast-4",
+          "ap-southeast-5",
+          "ap-southeast-7",
           "ca-central-1",
+          "ca-west-1",
           "eu-central-1",
           "eu-central-2",
           "eu-north-1",
           "eu-south-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "il-central-1",
+          "me-central-1",
           "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -7936,6 +7968,7 @@
           "sa-east-1",
           "us-east-1",
           "us-east-2",
+          "us-west-1",
           "us-west-2"
         ],
         "aws-cn": [],
@@ -9819,6 +9852,13 @@
         ]
       }
     },
+    "sagemakerautopilot": {
+      "regions": {
+        "aws": [],
+        "aws-cn": [],
+        "aws-us-gov": []
+      }
+    },
     "savingsplans": {
       "regions": {
         "aws": [
@@ -9901,7 +9941,10 @@
           "cn-north-1",
           "cn-northwest-1"
         ],
-        "aws-us-gov": []
+        "aws-us-gov": [
+          "us-gov-east-1",
+          "us-gov-west-1"
+        ]
       }
     },
     "schemas": {
@@ -10319,17 +10362,20 @@
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
+          "eu-central-2",
           "eu-north-1",
           "eu-south-1",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
           "il-central-1",
+          "me-central-1",
           "me-south-1",
           "sa-east-1",
           "us-east-1",
@@ -10352,17 +10398,20 @@
           "ap-northeast-2",
           "ap-northeast-3",
           "ap-south-1",
+          "ap-south-2",
           "ap-southeast-1",
           "ap-southeast-2",
           "ap-southeast-3",
           "ca-central-1",
           "eu-central-1",
+          "eu-central-2",
           "eu-north-1",
           "eu-south-1",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
           "il-central-1",
+          "me-central-1",
           "me-south-1",
           "sa-east-1",
           "us-east-1",

prowler/providers/aws/lib/s3/s3.py

@@ -1,12 +1,39 @@
+import os
 import tempfile
 from os import path
 from tempfile import NamedTemporaryFile
 from typing import Optional
 
-from botocore import exceptions
+from boto3.session import Session
+from botocore.exceptions import ClientError, NoCredentialsError, ProfileNotFound
 
 from prowler.lib.logger import logger
 from prowler.lib.outputs.output import Output
+from prowler.providers.aws.aws_provider import AwsProvider
+from prowler.providers.aws.config import (
+    AWS_STS_GLOBAL_ENDPOINT_REGION,
+    ROLE_SESSION_NAME,
+)
+from prowler.providers.aws.exceptions.exceptions import (
+    AWSAccessKeyIDInvalidError,
+    AWSArgumentTypeValidationError,
+    AWSAssumeRoleError,
+    AWSIAMRoleARNEmptyResourceError,
+    AWSIAMRoleARNInvalidAccountIDError,
+    AWSIAMRoleARNInvalidResourceTypeError,
+    AWSIAMRoleARNPartitionEmptyError,
+    AWSIAMRoleARNRegionNotEmtpyError,
+    AWSIAMRoleARNServiceNotIAMnorSTSError,
+    AWSNoCredentialsError,
+    AWSProfileNotFoundError,
+    AWSSecretAccessKeyInvalidError,
+    AWSSessionTokenExpiredError,
+    AWSSetUpSessionError,
+)
+from prowler.providers.aws.lib.arguments.arguments import (
+    validate_role_session_name,
+    validate_session_duration,
+)
 from prowler.providers.aws.lib.s3.exceptions.exceptions import (
     S3BucketAccessDeniedError,
     S3ClientError,
@@ -14,8 +41,11 @@ from prowler.providers.aws.lib.s3.exceptions.exceptions import (
     S3InvalidBucketNameError,
     S3TestConnectionError,
 )
-from prowler.providers.aws.lib.session.aws_set_up_session import AwsSetUpSession
-from prowler.providers.aws.models import AWSIdentityInfo, AWSSession
+from prowler.providers.aws.lib.session.aws_set_up_session import (
+    AwsSetUpSession,
+    parse_iam_credentials_arn,
+)
+from prowler.providers.aws.models import AWSAssumeRoleInfo, AWSIdentityInfo, AWSSession
 from prowler.providers.common.models import Connection
 
 
@@ -220,7 +250,18 @@ class S3:
 
     @staticmethod
     def test_connection(
-        session, bucket_name: str, raise_on_exception: bool = True
+        bucket_name: str,
+        profile: str = None,
+        aws_region: str = AWS_STS_GLOBAL_ENDPOINT_REGION,
+        role_arn: str = None,
+        role_session_name: str = ROLE_SESSION_NAME,
+        session_duration: int = 3600,
+        external_id: str = None,
+        mfa_enabled: bool = False,
+        raise_on_exception: bool = True,
+        aws_access_key_id: str = None,
+        aws_secret_access_key: str = None,
+        aws_session_token: Optional[str] = None,
     ) -> Connection:
         """
         Test the connection to the S3 bucket.
@@ -236,7 +277,39 @@ class S3:
         Raises:
         - Exception: An exception indicating that the connection test failed.
         """
+        # TODO: Refactor this method, the AWSProvider.test_connection() and the SecurityHubProvider.test_connection() are similar.
         try:
+            session = AwsProvider.setup_session(
+                mfa=mfa_enabled,
+                profile=profile,
+                aws_access_key_id=aws_access_key_id,
+                aws_secret_access_key=aws_secret_access_key,
+                aws_session_token=aws_session_token,
+            )
+
+            if role_arn:
+                session_duration = validate_session_duration(session_duration)
+                role_session_name = validate_role_session_name(role_session_name)
+                role_arn = parse_iam_credentials_arn(role_arn)
+                assumed_role_information = AWSAssumeRoleInfo(
+                    role_arn=role_arn,
+                    session_duration=session_duration,
+                    external_id=external_id,
+                    mfa_enabled=mfa_enabled,
+                    role_session_name=role_session_name,
+                )
+                assumed_role_credentials = AwsProvider.assume_role(
+                    session,
+                    assumed_role_information,
+                )
+                session = Session(
+                    aws_access_key_id=assumed_role_credentials.aws_access_key_id,
+                    aws_secret_access_key=assumed_role_credentials.aws_secret_access_key,
+                    aws_session_token=assumed_role_credentials.aws_session_token,
+                    region_name=aws_region,
+                    profile_name=profile,
+                )
+
             s3_client = session.client(__class__.__name__.lower())
             if "s3://" in bucket_name:
                 bucket_name = bucket_name.removeprefix("s3://")
@@ -273,7 +346,125 @@ class S3:
             )
             return Connection(is_connected=True)
 
-        except exceptions.ClientError as client_error:
+        except AWSSetUpSessionError as setup_session_error:
+            logger.error(
+                f"{setup_session_error.__class__.__name__}[{setup_session_error.__traceback__.tb_lineno}]: {setup_session_error}"
+            )
+            if raise_on_exception:
+                raise setup_session_error
+            return Connection(error=setup_session_error)
+
+        except AWSArgumentTypeValidationError as validation_error:
+            logger.error(
+                f"{validation_error.__class__.__name__}[{validation_error.__traceback__.tb_lineno}]: {validation_error}"
+            )
+            if raise_on_exception:
+                raise validation_error
+            return Connection(error=validation_error)
+
+        except AWSIAMRoleARNRegionNotEmtpyError as arn_region_not_empty_error:
+            logger.error(
+                f"{arn_region_not_empty_error.__class__.__name__}[{arn_region_not_empty_error.__traceback__.tb_lineno}]: {arn_region_not_empty_error}"
+            )
+            if raise_on_exception:
+                raise arn_region_not_empty_error
+            return Connection(error=arn_region_not_empty_error)
+
+        except AWSIAMRoleARNPartitionEmptyError as arn_partition_empty_error:
+            logger.error(
+                f"{arn_partition_empty_error.__class__.__name__}[{arn_partition_empty_error.__traceback__.tb_lineno}]: {arn_partition_empty_error}"
+            )
+            if raise_on_exception:
+                raise arn_partition_empty_error
+            return Connection(error=arn_partition_empty_error)
+
+        except AWSIAMRoleARNServiceNotIAMnorSTSError as arn_service_not_iam_sts_error:
+            logger.error(
+                f"{arn_service_not_iam_sts_error.__class__.__name__}[{arn_service_not_iam_sts_error.__traceback__.tb_lineno}]: {arn_service_not_iam_sts_error}"
+            )
+            if raise_on_exception:
+                raise arn_service_not_iam_sts_error
+            return Connection(error=arn_service_not_iam_sts_error)
+
+        except AWSIAMRoleARNInvalidAccountIDError as arn_invalid_account_id_error:
+            logger.error(
+                f"{arn_invalid_account_id_error.__class__.__name__}[{arn_invalid_account_id_error.__traceback__.tb_lineno}]: {arn_invalid_account_id_error}"
+            )
+            if raise_on_exception:
+                raise arn_invalid_account_id_error
+            return Connection(error=arn_invalid_account_id_error)
+
+        except AWSIAMRoleARNInvalidResourceTypeError as arn_invalid_resource_type_error:
+            logger.error(
+                f"{arn_invalid_resource_type_error.__class__.__name__}[{arn_invalid_resource_type_error.__traceback__.tb_lineno}]: {arn_invalid_resource_type_error}"
+            )
+            if raise_on_exception:
+                raise arn_invalid_resource_type_error
+            return Connection(error=arn_invalid_resource_type_error)
+
+        except AWSIAMRoleARNEmptyResourceError as arn_empty_resource_error:
+            logger.error(
+                f"{arn_empty_resource_error.__class__.__name__}[{arn_empty_resource_error.__traceback__.tb_lineno}]: {arn_empty_resource_error}"
+            )
+            if raise_on_exception:
+                raise arn_empty_resource_error
+            return Connection(error=arn_empty_resource_error)
+
+        except AWSAssumeRoleError as assume_role_error:
+            logger.error(
+                f"{assume_role_error.__class__.__name__}[{assume_role_error.__traceback__.tb_lineno}]: {assume_role_error}"
+            )
+            if raise_on_exception:
+                raise assume_role_error
+            return Connection(error=assume_role_error)
+
+        except ProfileNotFound as profile_not_found_error:
+            logger.error(
+                f"AWSProfileNotFoundError[{profile_not_found_error.__traceback__.tb_lineno}]: {profile_not_found_error}"
+            )
+            if raise_on_exception:
+                raise AWSProfileNotFoundError(
+                    file=os.path.basename(__file__),
+                    original_exception=profile_not_found_error,
+                ) from profile_not_found_error
+            return Connection(error=profile_not_found_error)
+
+        except NoCredentialsError as no_credentials_error:
+            logger.error(
+                f"AWSNoCredentialsError[{no_credentials_error.__traceback__.tb_lineno}]: {no_credentials_error}"
+            )
+            if raise_on_exception:
+                raise AWSNoCredentialsError(
+                    file=os.path.basename(__file__),
+                    original_exception=no_credentials_error,
+                ) from no_credentials_error
+            return Connection(error=no_credentials_error)
+
+        except AWSAccessKeyIDInvalidError as access_key_id_invalid_error:
+            logger.error(
+                f"{access_key_id_invalid_error.__class__.__name__}[{access_key_id_invalid_error.__traceback__.tb_lineno}]: {access_key_id_invalid_error}"
+            )
+            if raise_on_exception:
+                raise access_key_id_invalid_error
+            return Connection(error=access_key_id_invalid_error)
+
+        except AWSSecretAccessKeyInvalidError as secret_access_key_invalid_error:
+            logger.error(
+                f"{secret_access_key_invalid_error.__class__.__name__}[{secret_access_key_invalid_error.__traceback__.tb_lineno}]: {secret_access_key_invalid_error}"
+            )
+            if raise_on_exception:
+                raise secret_access_key_invalid_error
+            return Connection(error=secret_access_key_invalid_error)
+
+        except AWSSessionTokenExpiredError as session_token_expired:
+            logger.error(
+                f"{session_token_expired.__class__.__name__}[{session_token_expired.__traceback__.tb_lineno}]: {session_token_expired}"
+            )
+            if raise_on_exception:
+                raise session_token_expired
+            return Connection(error=session_token_expired)
+
+        except ClientError as client_error:
             if raise_on_exception:
                 if (
                     "specified bucket does not exist"
@@ -291,9 +482,9 @@ class S3:
                     raise S3BucketAccessDeniedError(original_exception=client_error)
                 else:
                     raise S3ClientError(original_exception=client_error)
-            return Connection(is_connected=False, error=client_error)
+            return Connection(error=client_error)
 
         except Exception as error:
             if raise_on_exception:
                 raise S3TestConnectionError(original_exception=error)
-            return False
+            return Connection(error=error)

prowler/providers/aws/services/codebuild/codebuild_project_not_publicly_accessible/codebuild_project_not_publicly_accessible.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "aws",
+  "CheckID": "codebuild_project_not_publicly_accessible",
+  "CheckTitle": "Ensure AWS CodeBuild projects are not public",
+  "CheckType": [],
+  "ServiceName": "codebuild",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "arn:aws:codebuild:region:account-id:project:project-name",
+  "Severity": "high",
+  "ResourceType": "AwsCodeBuildProject",
+  "Description": "Check for CodeBuild projects ensuring that the project visibility is appropriate",
+  "Risk": "Public CodeBuild Project ensures all build logs and artifacts are available to the public. Environment variables, source code, and other sensitive information may have been output to the build logs and artifacts. You must be careful about what information is output to the build logs.",
+  "RelatedUrl": "",
+  "Remediation": {
+    "Code": {
+      "NativeIaC": "",
+      "Terraform": "",
+      "CLI": "aws codebuild update-project --name <project-name> --project-visibility PRIVATE",
+      "Other": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure that all CodeBuild projects are private to avoid fact gathering about builds from an Attacker.",
+      "Url": "https://docs.aws.amazon.com/codebuild/latest/userguide/public-builds.html"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/aws/services/codebuild/codebuild_project_not_publicly_accessible/codebuild_project_not_publicly_accessible.py

@@ -0,0 +1,26 @@
+from typing import List
+
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.codebuild.codebuild_client import codebuild_client
+
+
+class codebuild_project_not_publicly_accessible(Check):
+    def execute(self) -> List[Check_Report_AWS]:
+        findings = []
+
+        projects = codebuild_client.projects
+        for arn, project in projects.items():
+            report = Check_Report_AWS(self.metadata(), resource=project)
+            report.resource_id = project.name
+            report.resource_arn = arn
+            report.region = project.region
+            report.status = "FAIL"
+            report.status_extended = f"CodeBuild project {project.name} is public."
+
+            if project.project_visibility == "PRIVATE":
+                report.status = "PASS"
+                report.status_extended = f"CodeBuild project {project.name} is private."
+
+            findings.append(report)
+
+        return findings

prowler/providers/aws/services/codebuild/codebuild_service.py

@@ -121,6 +121,7 @@ class Codebuild(AWSService):
             )
             project.tags = project_info.get("tags", [])
             project.service_role_arn = project_info.get("serviceRole", "")
+            project.project_visibility = project_info.get("projectVisibility", "")
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -222,6 +223,7 @@ class Project(BaseModel):
     s3_logs: Optional[s3Logs]
     cloudwatch_logs: Optional[CloudWatchLogs]
     tags: Optional[list]
+    project_visibility: Optional[str] = None
 
 
 class ExportConfig(BaseModel):

prowler/providers/aws/services/ec2/ec2_launch_template_imdsv2_required/ec2_launch_template_imdsv2_required.py

@@ -18,7 +18,10 @@ class ec2_launch_template_imdsv2_required(Check):
                     and version.template_data.http_tokens == "required"
                 ):
                     versions_with_imdsv2_required.append(str(version.version_number))
-                elif version.template_data.http_endpoint == "disabled":
+                elif (
+                    version.template_data.http_endpoint == "disabled"
+                    or not version.template_data.http_endpoint
+                ):
                     versions_with_metadata_disabled.append(str(version.version_number))
                 else:
                     versions_with_no_imdsv2.append(str(version.version_number))

prowler/providers/aws/services/iam/iam_no_custom_policy_permissive_role_assumption/iam_no_custom_policy_permissive_role_assumption.py

@@ -5,6 +5,14 @@ from prowler.providers.aws.services.iam.iam_client import iam_client
 class iam_no_custom_policy_permissive_role_assumption(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
+
+        def resource_has_wildcard(resource):
+            if isinstance(resource, str):
+                return "*" in resource
+            if isinstance(resource, list):
+                return any("*" in r for r in resource)
+            return False
+
         for policy in iam_client.policies:
             # Check only custom policies
             if policy.type == "Custom":
@@ -12,6 +20,7 @@ class iam_no_custom_policy_permissive_role_assumption(Check):
                 report.region = iam_client.region
                 report.status = "PASS"
                 report.status_extended = f"Custom Policy {policy.name} does not allow permissive STS Role assumption."
+
                 if policy.document:
                     if not isinstance(policy.document["Statement"], list):
                         policy_statements = [policy.document["Statement"]]
@@ -19,30 +28,23 @@ class iam_no_custom_policy_permissive_role_assumption(Check):
                         policy_statements = policy.document["Statement"]
                     for statement in policy_statements:
                         if (
-                            statement["Effect"] == "Allow"
+                            statement.get("Effect") == "Allow"
                             and "Action" in statement
                             and "Resource" in statement
-                            and "*" in statement["Resource"]
+                            and resource_has_wildcard(statement["Resource"])
                         ):
-                            if isinstance(statement["Action"], list):
-                                for action in statement["Action"]:
-                                    if (
-                                        action == "sts:AssumeRole"
-                                        or action == "sts:*"
-                                        or action == "*"
-                                    ):
-                                        report.status = "FAIL"
-                                        report.status_extended = f"Custom Policy {policy.name} allows permissive STS Role assumption."
-                                        break
-                            else:
-                                if (
-                                    statement["Action"] == "sts:AssumeRole"
-                                    or statement["Action"] == "sts:*"
-                                    or statement["Action"] == "*"
-                                ):
+                            actions = (
+                                statement["Action"]
+                                if isinstance(statement["Action"], list)
+                                else [statement["Action"]]
+                            )
+                            for action in actions:
+                                if action in ["sts:AssumeRole", "sts:*", "*"]:
                                     report.status = "FAIL"
                                     report.status_extended = f"Custom Policy {policy.name} allows permissive STS Role assumption."
-                            break
+                                    break
+                            if report.status == "FAIL":
+                                break
 
                 findings.append(report)
 

prowler/providers/azure/services/defender/defender_service.py

@@ -161,7 +161,8 @@ class Defender(AzureService):
                     {
                         security_contact_default.name: SecurityContacts(
                             resource_id=security_contact_default.id,
-                            name=getattr(security_contact_default, "name", "default"),
+                            name=getattr(security_contact_default, "name", "default")
+                            or "default",
                             emails=security_contact_default.emails,
                             phone=security_contact_default.phone,
                             alert_notifications_minimal_severity=security_contact_default.alert_notifications.minimal_severity,

prowler/providers/azure/services/recovery/recovery_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.azure.services.recovery.recovery_service import Recovery
+from prowler.providers.common.provider import Provider
+
+recovery_client = Recovery(Provider.get_global_provider())

prowler/providers/azure/services/recovery/recovery_service.py

@@ -0,0 +1,101 @@
+from typing import Optional
+
+from azure.mgmt.recoveryservices import RecoveryServicesClient
+from azure.mgmt.recoveryservicesbackup import RecoveryServicesBackupClient
+from azure.mgmt.recoveryservicesbackup.activestamp.models import DataSourceType
+from pydantic import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.providers.azure.azure_provider import AzureProvider
+from prowler.providers.azure.lib.service.service import AzureService
+
+
+class BackupItem(BaseModel):
+    """Minimal BackupItem: only essential identifying and descriptive fields."""
+
+    id: str
+    name: str
+    workload_type: Optional[DataSourceType]
+
+
+class BackupVault(BaseModel):
+    """Minimal BackupVault: only essential identifying fields and its backup items."""
+
+    id: str
+    name: str
+    location: str
+    backup_protected_items: dict[str, BackupItem] = Field(default_factory=dict)
+
+
+class Recovery(AzureService):
+    def __init__(self, provider: AzureProvider):
+        super().__init__(RecoveryServicesClient, provider)
+        self.vaults: dict[str, dict[str, BackupVault]] = self._get_vaults()
+        RecoveryBackup(provider, self.vaults)
+
+    def _get_vaults(self) -> dict[str, dict[str, BackupVault]]:
+        """
+        Retrieve all Recovery Services vaults for each subscription.
+
+        Returns:
+            Nested dictionary of vaults by subscription.
+        """
+        logger.info("Recovery - Getting Recovery Services vaults...")
+        vaults_dict: dict[str, dict[str, BackupVault]] = {}
+        try:
+            vaults_dict: dict[str, dict[str, BackupVault]] = {}
+            for subscription_name, client in self.clients.items():
+                vaults = client.vaults.list_by_subscription_id()
+                vaults_dict[subscription_name] = {}
+                for vault in vaults:
+                    vault_obj = BackupVault(
+                        id=vault.id,
+                        name=vault.name,
+                        location=vault.location,
+                    )
+                    vaults_dict[subscription_name][vault_obj.id] = vault_obj
+        except Exception as error:
+            logger.error(
+                f"Subscription name: {subscription_name} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+        return vaults_dict
+
+
+class RecoveryBackup(AzureService):
+    def __init__(
+        self, provider: AzureProvider, vaults: dict[str, dict[str, BackupVault]]
+    ):
+        super().__init__(RecoveryServicesBackupClient, provider)
+        for subscription_name, vaults in vaults.items():
+            for vault in vaults.values():
+                vault.backup_protected_items = self._get_backup_protected_items(
+                    subscription_name=subscription_name, vault=vault
+                )
+
+    def _get_backup_protected_items(
+        self, subscription_name: str, vault: BackupVault
+    ) -> dict[str, BackupItem]:
+        """
+        Retrieve all backup protected items for a given vault.
+        """
+        logger.info("Recovery - Getting backup protected items...")
+        backup_protected_items_dict: dict[str, BackupItem] = {}
+        try:
+            backup_protected_items = self.clients[
+                subscription_name
+            ].backup_protected_items.list(
+                vault_name=vault.name,
+                resource_group_name=vault.id.split("/")[4],
+            )
+            for item in backup_protected_items:
+                item_properties = getattr(item, "properties", None)
+                backup_protected_items_dict[item.id] = BackupItem(
+                    id=item.id,
+                    name=item.name,
+                    workload_type=(
+                        item_properties.workload_type if item_properties else None
+                    ),
+                )
+        except Exception as e:
+            logger.error(f"Recovery - Error getting backup protected items: {e}")
+        return backup_protected_items_dict

prowler/providers/azure/services/storage/storage_service.py

@@ -158,6 +158,21 @@ class Storage(AzureService):
                         "share_delete_retention_policy",
                         None,
                     )
+
+                    smb_channel_encryption_raw = getattr(
+                        getattr(
+                            getattr(
+                                file_service_properties,
+                                "protocol_settings",
+                                None,
+                            ),
+                            "smb",
+                            None,
+                        ),
+                        "channel_encryption",
+                        None,
+                    )
+
                     account.file_service_properties = FileServiceProperties(
                         id=file_service_properties.id,
                         name=file_service_properties.name,
@@ -174,6 +189,13 @@ class Storage(AzureService):
                                 0,
                             ),
                         ),
+                        smb_protocol_settings=SMBProtocolSettings(
+                            channel_encryption=(
+                                smb_channel_encryption_raw.rstrip(";").split(";")
+                                if smb_channel_encryption_raw
+                                else []
+                            )
+                        ),
                     )
                 except Exception as error:
                     logger.error(
@@ -221,11 +243,16 @@ class ReplicationSettings(Enum):
     STANDARD_RAGZRS = "Standard_RAGZRS"
 
 
+class SMBProtocolSettings(BaseModel):
+    channel_encryption: list[str]
+
+
 class FileServiceProperties(BaseModel):
     id: str
     name: str
     type: str
     share_delete_retention_policy: DeleteRetentionPolicy
+    smb_protocol_settings: SMBProtocolSettings
 
 
 @dataclass

prowler/providers/azure/services/storage/storage_smb_channel_encryption_with_secure_algorithm/storage_smb_channel_encryption_with_secure_algorithm.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "storage_smb_channel_encryption_with_secure_algorithm",
+  "CheckTitle": "Ensure SMB channel encryption uses a secure algorithm for SMB file shares",
+  "CheckType": [],
+  "ServiceName": "storage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Storage/storageAccounts/{storageAccountName}/fileServices/default",
+  "Severity": "medium",
+  "ResourceType": "AzureStorageAccount",
+  "Description": "Implement SMB channel encryption with a secure algorithm for SMB file shares to ensure data confidentiality and integrity in transit.",
+  "Risk": "Not using the recommended SMB channel encryption may expose data transmitted over SMB channels to unauthorized interception and tampering.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-files#recommendations-for-smb-file-shares",
+  "Remediation": {
+    "Code": {
+      "CLI": "az storage account file-service-properties update --resource-group <resource-group> --account-name <storage-account> --channel-encryption AES-256-GCM",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Use the portal, CLI or PowerShell to set the SMB channel encryption to a secure algorithm.",
+      "Url": "https://learn.microsoft.com/en-us/azure/storage/files/files-smb-protocol?tabs=azure-portal#smb-security-settings"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check passes if SMB channel encryption is set to a secure algorithm."
+}

prowler/providers/azure/services/storage/storage_smb_channel_encryption_with_secure_algorithm/storage_smb_channel_encryption_with_secure_algorithm.py

@@ -0,0 +1,51 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.storage.storage_client import storage_client
+
+SECURE_ENCRYPTION_ALGORITHMS = ["AES-256-GCM"]
+
+
+class storage_smb_channel_encryption_with_secure_algorithm(Check):
+    """
+    Ensure SMB channel encryption for file shares is set to the recommended algorithm (AES-256-GCM or higher).
+
+    This check evaluates whether SMB file shares are configured to use only the recommended SMB channel encryption algorithms.
+    - PASS: Storage account has the recommended SMB channel encryption (AES-256-GCM or higher) enabled for file shares.
+    - FAIL: Storage account does not have the recommended SMB channel encryption enabled for file shares or uses an unsupported algorithm.
+    """
+
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+        for subscription, storage_accounts in storage_client.storage_accounts.items():
+            for account in storage_accounts:
+                if account.file_service_properties:
+                    pretty_current_algorithms = (
+                        ", ".join(
+                            account.file_service_properties.smb_protocol_settings.channel_encryption
+                        )
+                        if account.file_service_properties.smb_protocol_settings.channel_encryption
+                        else "none"
+                    )
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(),
+                        resource=account.file_service_properties,
+                    )
+                    report.subscription = subscription
+                    report.resource_name = account.name
+
+                    if (
+                        not account.file_service_properties.smb_protocol_settings.channel_encryption
+                    ):
+                        report.status = "FAIL"
+                        report.status_extended = f"Storage account {account.name} from subscription {subscription} does not have SMB channel encryption enabled for file shares."
+                    elif any(
+                        algorithm in SECURE_ENCRYPTION_ALGORITHMS
+                        for algorithm in account.file_service_properties.smb_protocol_settings.channel_encryption
+                    ):
+                        report.status = "PASS"
+                        report.status_extended = f"Storage account {account.name} from subscription {subscription} has a secure algorithm for SMB channel encryption ({', '.join(SECURE_ENCRYPTION_ALGORITHMS)}) enabled for file shares since it supports {pretty_current_algorithms}."
+                    else:
+                        report.status = "FAIL"
+                        report.status_extended = f"Storage account {account.name} from subscription {subscription} does not have SMB channel encryption with a secure algorithm for file shares since it supports {pretty_current_algorithms}."
+
+                    findings.append(report)
+        return findings

prowler/providers/azure/services/vm/vm_backup_enabled/vm_backup_enabled.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "vm_backup_enabled",
+  "CheckTitle": "Ensure Backups are enabled for Azure Virtual Machines",
+  "CheckType": [],
+  "ServiceName": "vm",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Microsoft.Compute/virtualMachines",
+  "Description": "Ensure that Microsoft Azure Backup service is in use for your Azure virtual machines (VMs) to protect against accidental deletion or corruption.",
+  "Risk": "Without Azure Backup enabled, VMs are at risk of data loss due to accidental deletion, corruption, or other failures, and recovery options are limited.",
+  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/backup/backup-overview",
+  "Remediation": {
+    "Code": {
+      "CLI": "az backup protection enable-for-vm --resource-group <resource-group> --vm <vm-name> --vault-name <vault-name> --policy-name DefaultPolicy",
+      "NativeIaC": "",
+      "Other": "https://learn.microsoft.com/en-us/azure/backup/quick-backup-vm-portal",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable Azure Backup for each VM by associating it with a Recovery Services vault and a backup policy.",
+      "Url": "https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/azure/services/vm/vm_backup_enabled/vm_backup_enabled.py

@@ -0,0 +1,50 @@
+from azure.mgmt.recoveryservicesbackup.activestamp.models import DataSourceType
+
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.recovery.recovery_client import recovery_client
+from prowler.providers.azure.services.vm.vm_client import vm_client
+
+
+class vm_backup_enabled(Check):
+    """
+    Ensure that Microsoft Azure Backup service is in use for your Azure virtual machines (VMs).
+
+    This check evaluates whether each Azure VM in the subscription is protected by Azure Backup.
+
+    - PASS: The VM is protected by Azure Backup (present in a Recovery Services vault).
+    - FAIL: The VM is not protected by Azure Backup (not present in any Recovery Services vault).
+    """
+
+    def execute(self) -> list[Check_Report_Azure]:
+        """Execute Azure VM backup enabled check.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for subscription_name, vms in vm_client.virtual_machines.items():
+            vaults = recovery_client.vaults.get(subscription_name, {})
+            for vm in vms.values():
+                found = False
+                found_vault_name = None
+                for vault in vaults.values():
+                    for backup_item in vault.backup_protected_items.values():
+                        if (
+                            backup_item.workload_type == DataSourceType.VM
+                            and backup_item.name.split(";")[-1] == vm.resource_name
+                        ):
+                            found = True
+                            found_vault_name = vault.name
+                            break
+                    if found:
+                        break
+                report = Check_Report_Azure(metadata=self.metadata(), resource=vm)
+                report.subscription = subscription_name
+                if found:
+                    report.status = "PASS"
+                    report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} is protected by Azure Backup (vault: {found_vault_name})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} is not protected by Azure Backup."
+                findings.append(report)
+        return findings

prowler/providers/azure/services/vm/vm_ensure_using_approved_images/vm_ensure_using_approved_images.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "vm_ensure_using_approved_images",
+  "CheckTitle": "Ensure that Azure VMs are using an approved machine image.",
+  "CheckType": [],
+  "ServiceName": "vm",
+  "SubServiceName": "image",
+  "ResourceIdTemplate": "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Compute/images/<virtual-machine-image-id>",
+  "Severity": "medium",
+  "ResourceType": "Microsoft.Compute/images",
+  "Description": "Ensure that all your Azure virtual machine instances are launched from approved machine images only.",
+  "Risk": "An approved machine image is a custom virtual machine (VM) image that contains a pre-configured OS and a well-defined stack of server software approved by Azure, fully configured to run your application. Using approved (golden) machine images to launch new VM instances within your Azure cloud environment brings major benefits such as fast and stable application deployment and scaling, secure application stack upgrades, and versioning.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/create-vm-generalized-managed",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/VirtualMachines/approved-machine-image.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Re-create the required VM instances using the approved (golden) machine image.",
+      "Url": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-vm-generalized-managed"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check only validates if the VM was launched from a custom image. It does not validate the image content or security baseline."
+}

prowler/providers/azure/services/vm/vm_ensure_using_approved_images/vm_ensure_using_approved_images.py

@@ -0,0 +1,33 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.vm.vm_client import vm_client
+
+
+class vm_ensure_using_approved_images(Check):
+    """
+    Ensure that Azure VMs are using an approved (custom) machine image.
+
+    This check evaluates whether Azure Virtual Machines are launched from an approved (custom) machine image by checking the image reference ID format.
+
+    - PASS: The Azure VM is using an approved custom machine image.
+    - FAIL: The Azure VM is not using an approved custom machine image.
+    """
+
+    def execute(self):
+        findings = []
+        for subscription_name, vms in vm_client.virtual_machines.items():
+            for vm in vms.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=vm)
+                report.subscription = subscription_name
+                image_id = getattr(vm, "image_reference", None)
+                if (
+                    image_id
+                    and image_id.startswith("/subscriptions/")
+                    and "/providers/Microsoft.Compute/images/" in image_id
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} is using an approved machine image: {image_id.split('/')[-1]}."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} is not using an approved machine image."
+                findings.append(report)
+        return findings

prowler/providers/azure/services/vm/vm_ensure_using_managed_disks/vm_ensure_using_managed_disks.py

@@ -15,17 +15,17 @@ class vm_ensure_using_managed_disks(Check):
 
                 using_managed_disks = (
                     True
-                    if vm.storage_profile
-                    and getattr(vm.storage_profile, "os_disk", False)
-                    and getattr(vm.storage_profile.os_disk, "managed_disk", False)
+                    if getattr(
+                        getattr(getattr(vm, "storage_profile", None), "os_disk", None),
+                        "managed_disk",
+                        None,
+                    )
                     else False
                 )
 
-                if using_managed_disks and getattr(
-                    vm.storage_profile, "data_disks", False
-                ):
+                if using_managed_disks and getattr(vm, "storage_profile", None):
                     for data_disk in vm.storage_profile.data_disks:
-                        if not getattr(data_disk, "managed_disk", False):
+                        if not getattr(data_disk, "managed_disk", None):
                             using_managed_disks = False
                             break
 

prowler/providers/azure/services/vm/vm_linux_enforce_ssh_authentication/vm_linux_enforce_ssh_authentication.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "vm_linux_enforce_ssh_authentication",
+  "CheckTitle": "Ensure SSH key authentication is enforced on Linux-based Virtual Machines",
+  "CheckType": [],
+  "ServiceName": "vm",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachines/{vmName}",
+  "Severity": "high",
+  "ResourceType": "Microsoft.Compute/virtualMachines",
+  "Description": "Ensure that Azure Linux-based virtual machines are configured to use SSH keys by disabling password authentication.",
+  "Risk": "Allowing password-based SSH authentication increases the risk of brute-force attacks and unauthorized access. Enforcing SSH key authentication ensures only users with the private key can access the VM.",
+  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-ssh-keys-detailed",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/VirtualMachines/ssh-authentication-type.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Recreate Linux VMs with SSH key authentication enabled and password authentication disabled.",
+      "Url": "https://docs.microsoft.com/en-us/azure/virtual-machines/linux/create-ssh-keys-detailed"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/azure/services/vm/vm_linux_enforce_ssh_authentication/vm_linux_enforce_ssh_authentication.py

@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.vm.vm_client import vm_client
+
+
+class vm_linux_enforce_ssh_authentication(Check):
+    """
+    Ensure that Azure Linux-based virtual machines are configured to use SSH keys (password authentication is disabled).
+
+    This check evaluates whether disablePasswordAuthentication is set to True for Linux VMs to ensure only SSH key authentication is allowed.
+    - PASS: VM has password authentication disabled (SSH key authentication enforced).
+    - FAIL: VM has password authentication enabled (password-based SSH allowed).
+    """
+
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+        for subscription_name, vms in vm_client.virtual_machines.items():
+            for vm in vms.values():
+                if vm.linux_configuration:
+                    report = Check_Report_Azure(metadata=self.metadata(), resource=vm)
+                    report.subscription = subscription_name
+
+                    if vm.linux_configuration.disable_password_authentication:
+                        report.status = "PASS"
+                        report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} has password authentication disabled (SSH key authentication enforced)."
+                    else:
+                        report.status = "FAIL"
+                        report.status_extended = f"VM {vm.resource_name} in subscription {subscription_name} has password authentication enabled (password-based SSH allowed)."
+                    findings.append(report)
+        return findings

prowler/providers/azure/services/vm/vm_scaleset_associated_with_load_balancer/vm_scaleset_associated_with_load_balancer.metadata.json

@@ -0,0 +1,30 @@
+{
+  "Provider": "azure",
+  "CheckID": "vm_scaleset_associated_with_load_balancer",
+  "CheckTitle": "VM Scale Set Is Associated With Load Balancer",
+  "CheckType": [],
+  "ServiceName": "vm",
+  "SubServiceName": "scaleset",
+  "ResourceIdTemplate": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/virtualMachineScaleSets/{vmScaleSetName}",
+  "Severity": "medium",
+  "ResourceType": "Microsoft.Compute/virtualMachineScaleSets",
+  "Description": "Ensure that your Azure virtual machine scale sets are using load balancers for traffic distribution.",
+  "Risk": "Without load balancer integration, Azure virtual machine scale sets may experience reduced availability and potential service disruptions during traffic spikes or instance failures, leading to degraded user experience and potential business impact.",
+  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/virtual-network/network-overview",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/VirtualMachines/associated-load-balancers.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Attach a load balancer to your Azure virtual machine scale set to ensure high availability and optimal traffic distribution.",
+      "Url": "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview"
+    }
+  },
+  "Categories": [],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}