chore: fix PR number

This reverts commit 2609f04b69.

prowler/CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### 🚀 Added
 
 - `entra_conditional_access_policy_device_code_flow_blocked` check for M365 provider [(#10218)](https://github.com/prowler-cloud/prowler/pull/10218)
+- CheckMetadata Pydantic validators [(#8584)](https://github.com/prowler-cloud/prowler/pull/8583)
 
 ### 🔄 Changed
 

prowler/lib/check/models.py

@@ -1,4 +1,5 @@
 import functools
+import json
 import os
 import re
 import sys
@@ -15,6 +16,115 @@ from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.check.utils import recover_checks_from_provider
 from prowler.lib.logger import logger
 
+# Valid ResourceGroup values as defined in the RFC
+VALID_RESOURCE_GROUPS = frozenset(
+    {
+        "compute",
+        "container",
+        "serverless",
+        "database",
+        "storage",
+        "network",
+        "IAM",
+        "messaging",
+        "security",
+        "monitoring",
+        "api_gateway",
+        "ai_ml",
+        "governance",
+        "collaboration",
+        "devops",
+        "analytics",
+    }
+)
+
+# Valid Categories as defined in the RFC
+VALID_CATEGORIES = frozenset(
+    {
+        "encryption",
+        "internet-exposed",
+        "logging",
+        "secrets",
+        "resilience",
+        "threat-detection",
+        "trust-boundaries",
+        "vulnerabilities",
+        "cluster-security",
+        "container-security",
+        "node-security",
+        "gen-ai",
+        "ci-cd",
+        "identity-access",
+        "email-security",
+        "forensics-ready",
+        "software-supply-chain",
+        "e3",
+        "e5",
+        "privilege-escalation",
+        "ec2-imdsv1",
+    }
+)
+
+
+@functools.lru_cache(maxsize=1)
+def _load_aws_check_types_hierarchy() -> dict:
+    """
+    Load and cache the AWS CheckTypes hierarchy from the JSON config file.
+
+    Returns:
+        dict: The CheckTypes hierarchy, or empty dict if file not found.
+    """
+    try:
+        current_dir = os.path.dirname(os.path.abspath(__file__))
+        check_types_file = os.path.normpath(
+            os.path.join(
+                current_dir,
+                "..",
+                "..",
+                "providers",
+                "aws",
+                "config",
+                "check_types.json",
+            )
+        )
+
+        if not os.path.exists(check_types_file):
+            return {}
+
+        with open(check_types_file, "r") as f:
+            return json.load(f)
+
+    except (FileNotFoundError, json.JSONDecodeError):
+        return {}
+
+
+def _validate_aws_check_type_in_config(check_type: str) -> bool:
+    """
+    Validate if a CheckType exists in the AWS config using direct lookups.
+    Supports partial paths: namespace, namespace/category, namespace/category/classifier
+
+    Args:
+        check_type: The CheckType string to validate (e.g., "TTPs/Initial Access")
+
+    Returns:
+        bool: True if the CheckType path exists in the config hierarchy
+    """
+    if not check_type:
+        return False
+
+    hierarchy = _load_aws_check_types_hierarchy()
+    if not hierarchy:
+        return False
+
+    path_parts = check_type.split("/")
+    current_level = hierarchy
+    for part in path_parts:
+        if not isinstance(current_level, dict) or part not in current_level:
+            return False
+        current_level = current_level[part]
+
+    return True
+
 
 class Code(BaseModel):
     """
@@ -94,11 +204,19 @@ class CheckMetadata(BaseModel):
         Compliance (list, optional): The compliance information for the check. Defaults to None.
 
     Validators:
-        valid_category(value): Validator function to validate the categories of the check.
+        valid_category(value): Validator function to validate the categories of the check against predefined values.
         severity_to_lower(severity): Validator function to convert the severity to lowercase.
-        valid_severity(severity): Validator function to validate the severity of the check.
         valid_cli_command(remediation): Validator function to validate the CLI command is not an URL.
         valid_resource_type(resource_type): Validator function to validate the resource type is not empty.
+        validate_service_name(service_name, values): Validator function to validate the service name matches CheckID.
+        valid_check_id(check_id): Validator function to validate the CheckID format.
+        validate_check_title(check_title): Validator function to validate CheckTitle max length (150 chars) and not starting with 'Ensure'.
+        validate_related_url(related_url): Validator function to validate RelatedUrl is empty (deprecated field).
+        validate_recommendation_url(remediation): Validator function to validate Recommendation URL points to Prowler Hub.
+        validate_check_type(check_type, values): Validator function to validate CheckType - must be empty for non-AWS providers, no empty strings and predefined types validation for AWS.
+        validate_description(description): Validator function to validate Description max length (400 chars).
+        validate_risk(risk): Validator function to validate Risk max length (400 chars).
+        validate_resource_group(resource_group): Validator function to validate ResourceGroup against predefined values.
         validate_additional_urls(additional_urls): Validator function to ensure AdditionalURLs contains no duplicates.
     """
 
@@ -135,6 +253,10 @@ class CheckMetadata(BaseModel):
             raise ValueError(
                 f"Invalid category: {value}. Categories can only contain lowercase letters, numbers and hyphen '-'"
             )
+        if value_lower not in VALID_CATEGORIES:
+            raise ValueError(
+                f"Invalid category: '{value_lower}'. Must be one of: {', '.join(sorted(VALID_CATEGORIES))}."
+            )
         return value_lower
 
     @validator("Severity", pre=True, always=True)
@@ -183,6 +305,86 @@ class CheckMetadata(BaseModel):
 
         return check_id
 
+    @validator("CheckTitle", pre=True, always=True)
+    def validate_check_title(cls, check_title):
+        if len(check_title) > 150:
+            raise ValueError(
+                f"CheckTitle must not exceed 150 characters, got {len(check_title)} characters"
+            )
+        if check_title.startswith("Ensure"):
+            raise ValueError(
+                "CheckTitle must not start with 'Ensure'. Use a descriptive title that focuses on the security state."
+            )
+        return check_title
+
+    @validator("RelatedUrl", pre=True, always=True)
+    def validate_related_url(cls, related_url):
+        if related_url:
+            raise ValueError("RelatedUrl must be empty. This field is deprecated.")
+        return related_url
+
+    @validator("Remediation")
+    def validate_recommendation_url(remediation):
+        url = remediation.Recommendation.Url
+        if url and not url.startswith("https://hub.prowler.com/"):
+            raise ValueError(
+                f"Remediation Recommendation URL must point to Prowler Hub (https://hub.prowler.com/...), got '{url}'."
+            )
+        return remediation
+
+    @validator("CheckType", pre=True, always=True)
+    def validate_check_type(cls, check_type, values):
+        provider = values.get("Provider", "").lower()
+
+        # Non-AWS providers must have an empty CheckType list
+        if provider != "aws" and provider not in EXTERNAL_TOOL_PROVIDERS:
+            if check_type:
+                raise ValueError(
+                    f"CheckType must be empty for non-AWS providers. Got {check_type} for provider '{provider}'."
+                )
+            return check_type
+
+        # Check for empty strings in the list - applies to AWS
+        for i, check_type_item in enumerate(check_type):
+            if not check_type_item or check_type_item.strip() == "":
+                raise ValueError(
+                    f"CheckType list cannot contain empty strings. Found empty string at index {i}."
+                )
+
+        # For AWS provider, validate against config hierarchy
+        if provider == "aws":
+            for check_type_item in check_type:
+                if not _validate_aws_check_type_in_config(check_type_item):
+                    raise ValueError(
+                        f"Invalid CheckType: '{check_type_item}'. Must be a valid path in the AWS CheckType hierarchy. See prowler/providers/aws/config/check_types.json for valid values."
+                    )
+
+        return check_type
+
+    @validator("Description", pre=True, always=True)
+    def validate_description(cls, description):
+        if len(description) > 400:
+            raise ValueError(
+                f"Description must not exceed 400 characters, got {len(description)} characters"
+            )
+        return description
+
+    @validator("Risk", pre=True, always=True)
+    def validate_risk(cls, risk):
+        if len(risk) > 400:
+            raise ValueError(
+                f"Risk must not exceed 400 characters, got {len(risk)} characters"
+            )
+        return risk
+
+    @validator("ResourceGroup", pre=True, always=True)
+    def validate_resource_group(cls, resource_group):
+        if resource_group and resource_group not in VALID_RESOURCE_GROUPS:
+            raise ValueError(
+                f"Invalid ResourceGroup: '{resource_group}'. Must be one of: {', '.join(sorted(VALID_RESOURCE_GROUPS))} or empty string."
+            )
+        return resource_group
+
     @validator("AdditionalURLs", pre=True, always=True)
     def validate_additional_urls(cls, additional_urls):
         if not isinstance(additional_urls, list):

prowler/providers/alibabacloud/services/actiontrail/actiontrail_multi_region_enabled/actiontrail_multi_region_enabled.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "critical",
   "ResourceType": "ALIYUN::ACTIONTRAIL::Trail",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud ActionTrail** is a service that records API calls made to your account and delivers log files containing the identity of the API caller, the time and source IP of the call, the request parameters, and the response elements returned by the service. Ensuring that a **multi-region trail** exists guarantees that management operations performed across all regions and global services are captured, enabling detection of unexpected activities in otherwise unused regions.",
+  "Description": "**Alibaba Cloud ActionTrail** records API calls made to your account, including caller identity, time, source IP, request parameters, and response elements. Ensuring a **multi-region trail** exists guarantees that operations across all regions and global services are captured, enabling detection of unexpected activities in unused regions.",
   "Risk": "Without a **multi-region trail** enabled, API calls made in regions outside the primary trail's scope will not be recorded. This creates blind spots in **security analysis**, **resource change tracking**, and **compliance auditing**, potentially allowing unauthorized or malicious activity to go undetected across your Alibaba Cloud account.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/alibabacloud/services/cs/cs_kubernetes_cloudmonitor_enabled/cs_kubernetes_cloudmonitor_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud CloudMonitor** agent provides visibility into system metrics for **Kubernetes Engine clusters**, including CPU utilization, disk traffic, network traffic, and disk IO information. Without the CloudMonitor agent enabled, operators lack critical observability into node and pod health, making it difficult to detect performance degradation or anomalous resource consumption. Enabling CloudMonitor ensures that a monitor controller is created to periodically connect to each node, collect metrics about its Pods and containers, and send them to the **CloudMonitor** server for analysis and alerting.",
-  "Risk": "Without **CloudMonitor** enabled on Kubernetes Engine clusters, there is no automated collection of system-level metrics such as CPU, memory, disk, and network usage. This lack of visibility can delay detection of **resource exhaustion**, **node failures**, and **abnormal workload behavior**, increasing the risk of undetected **availability** and **performance** issues. In a security context, the absence of monitoring data impairs the ability to identify **denial-of-service conditions** or **cryptojacking** activities running on cluster nodes.",
+  "Description": "**CloudMonitor** agent provides visibility into system metrics for **Kubernetes Engine clusters**, including CPU, disk, network, and IO. Without it, operators lack observability into node and pod health. Enabling CloudMonitor creates a controller that collects metrics from each node's Pods and containers for analysis and alerting.",
+  "Risk": "Without **CloudMonitor**, there is no automated collection of system metrics (CPU, memory, disk, network). This delays detection of **resource exhaustion**, **node failures**, and **abnormal workloads**, increasing risk of undetected **availability** issues. It also impairs identification of **denial-of-service** or **cryptojacking** on cluster nodes.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_recent/cs_kubernetes_cluster_check_recent.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** provides a cluster health check feature that validates the health state of each node and verifies the cluster configuration, including `kubelet`, `docker daemon`, `kernel`, and network `iptables` settings. Running these checks regularly ensures that cloud resources such as **VPC/VSwitch**, **SLB**, and every **ECS node** are functioning correctly. If consecutive health check failures are detected, diagnostic reports are generated for administrators to take corrective action.",
-  "Risk": "Without regular cluster health checks within the configured period, potential issues such as **node failures**, **misconfigured network rules**, or **degraded system components** may go undetected. This increases the risk of **cluster instability**, **service outages**, and **security vulnerabilities** that could be exploited by attackers. Delayed detection of unhealthy nodes or misconfigured components can also impact the **integrity** and **availability** of workloads running on the cluster.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** provides a cluster health check that validates node health and cluster configuration, including `kubelet`, `docker daemon`, `kernel`, and `iptables` settings. Running checks regularly ensures **VPC/VSwitch**, **SLB**, and **ECS nodes** function correctly. Consecutive failures generate diagnostic reports for corrective action.",
+  "Risk": "Without regular cluster health checks, **node failures**, **misconfigured network rules**, or **degraded components** may go undetected, increasing the risk of **cluster instability**, **service outages**, and exploitable **security vulnerabilities**. Delayed detection of unhealthy nodes can impact the **integrity** and **availability** of workloads running on the cluster.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_cluster_check_weekly/cs_kubernetes_cluster_check_weekly.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** provides a cluster health check feature that validates the health state of each node and verifies the cluster configuration, including `kubelet`, `docker daemon`, `kernel`, and network `iptables` settings. Running these checks at least once per week ensures that cloud resources such as **VPC/VSwitch**, **SLB**, and every **ECS node** are functioning correctly. If consecutive health check failures are detected, diagnostic reports are generated for administrators to take corrective action.",
-  "Risk": "Without weekly cluster health checks, potential issues such as **node failures**, **misconfigured network rules**, or **degraded system components** may go undetected for extended periods. This increases the risk of **cluster instability**, **service outages**, and **security vulnerabilities** that could be exploited by attackers. Delayed detection of unhealthy nodes or misconfigured components can also impact the **integrity** and **availability** of workloads running on the cluster.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** provides a cluster health check that validates node health and cluster configuration, including `kubelet`, `docker daemon`, `kernel`, and `iptables` settings. Weekly checks ensure **VPC/VSwitch**, **SLB**, and **ECS nodes** function correctly. Consecutive failures generate diagnostic reports for corrective action.",
+  "Risk": "Without weekly health checks, **node failures**, **misconfigured network rules**, or **degraded components** may go undetected for extended periods, increasing the risk of **cluster instability**, **service outages**, and exploitable **security vulnerabilities**. Delayed detection can impact the **integrity** and **availability** of workloads on the cluster.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_dashboard_disabled/cs_kubernetes_dashboard_disabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should not have the **Kubernetes Dashboard** (web UI) enabled. The Dashboard is backed by a highly privileged Kubernetes Service Account that can perform administrative operations across the cluster. It is recommended to use the **ACK Console** instead, which provides fine-grained access control through RAM policies and RBAC integration, avoiding the risk of privilege escalation through a compromised dashboard.",
-  "Risk": "The **Kubernetes Dashboard** is backed by a highly privileged Service Account that grants broad access to cluster resources. If the Dashboard is compromised through a vulnerability or unauthorized access, an attacker could gain **full control** over the cluster, deploy malicious workloads, exfiltrate **secrets**, and **escalate privileges**. This directly impacts the **confidentiality**, **integrity**, and **availability** of all workloads and data within the cluster.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should not have the **Kubernetes Dashboard** (web UI) enabled. The Dashboard uses a highly privileged Service Account that can perform administrative operations across the cluster. Use the **ACK Console** instead, which provides fine-grained access control through RAM policies and RBAC integration.",
+  "Risk": "The **Kubernetes Dashboard** uses a highly privileged Service Account with broad cluster access. If compromised through a vulnerability or unauthorized access, an attacker could gain **full control** over the cluster, deploy malicious workloads, exfiltrate **secrets**, and **escalate privileges**, impacting **confidentiality**, **integrity**, and **availability** of all workloads and data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/86494.html",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_eni_multiple_ip_enabled/cs_kubernetes_eni_multiple_ip_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Elastic Network Interface (ENI)** supports assigning multiple IP addresses to a single virtual machine's network interface. With **ENI multiple IP mode** provided by the **Terway** network plugin, Kubernetes Engine clusters can allocate pod IP addresses from the VPC CIDR block, enabling better scalability and native integration with other Alibaba Cloud services. This mode allows pods to have their own security group associations, providing granular network-level access control independently from their host nodes.",
-  "Risk": "Without **ENI multiple IP mode** (provided by the **Terway** network plugin), pods share the node's network interface in a less scalable manner and cannot have independent security group associations. This limits the ability to apply **granular firewall controls** at the pod level, increasing the risk of **lateral movement** if a pod is compromised. The inability to isolate pod networking from node networking weakens **network segmentation** and reduces the overall **security posture** of the cluster.",
+  "Description": "With **ENI multiple IP mode** provided by the **Terway** network plugin, Kubernetes Engine clusters allocate pod IPs from the VPC CIDR block, enabling better scalability and native integration with Alibaba Cloud services. This mode allows pods to have their own security group associations, providing granular network-level access control independently from host nodes.",
+  "Risk": "Without **ENI multiple IP mode** (**Terway** plugin), pods share the node's network interface and cannot have independent security group associations. This limits **granular firewall controls** at the pod level, increasing **lateral movement** risk if a pod is compromised. The inability to isolate pod from node networking weakens **network segmentation** and the cluster's **security posture**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/ack-managed-and-ack-dedicated/user-guide/associate-multiple-security-groups-with-an-eni",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_log_service_enabled/cs_kubernetes_log_service_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Log Service** is a real-time data logging service that supports collection, shipping, search, storage, and analysis for container and audit logs in **Kubernetes Engine clusters**. When enabled, Log Service automatically collects `kube-apiserver` audit logs, ingress visiting logs, and standard output/error logs from containerized processes. These logs are stored in a dedicated, persistent datastore and are essential for operational visibility, security monitoring, and compliance auditing.",
-  "Risk": "Without **Log Service** enabled, there is no centralized collection of container logs, audit trails, or cluster events. This severely impairs the ability to perform **incident investigation**, **compliance auditing**, and **security monitoring**. Attackers could operate undetected within the cluster, as there would be no audit trail of API server calls, pod lifecycle events, or container output. The lack of logging directly impacts the **confidentiality** and **integrity** of the cluster by removing a critical detection and forensic capability.",
+  "Description": "**Alibaba Cloud Log Service** supports collection, search, storage, and analysis for container and audit logs in **Kubernetes Engine clusters**. When enabled, it automatically collects `kube-apiserver` audit logs, ingress logs, and stdout/stderr from containers. These logs are stored persistently and are essential for operational visibility, security monitoring, and compliance auditing.",
+  "Risk": "Without **Log Service**, there is no centralized collection of container logs or cluster events, impairing **incident investigation**, **compliance auditing**, and **security monitoring**. Attackers could operate undetected with no audit trail of API server calls or pod events, impacting cluster **confidentiality** and **integrity**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_network_policy_enabled/cs_kubernetes_network_policy_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should have **Network Policy** support enabled through the **Terway** network plugin. A `NetworkPolicy` is a Kubernetes specification that defines how groups of pods are allowed to communicate with each other and other network endpoints using label-based selection rules. By default, pods are non-isolated and accept traffic from any source; applying NetworkPolicy resources restricts traffic to only explicitly allowed connections, enforcing the principle of least privilege at the network level.",
-  "Risk": "Without **Network Policies**, all pods in a Kubernetes cluster can communicate with each other freely, creating an unrestricted flat network. This allows an attacker who compromises a single pod to move **laterally** within the cluster, accessing sensitive services, databases, and secrets without restriction. The absence of network segmentation undermines **defense in depth** and increases the blast radius of any compromise, directly impacting the **confidentiality** and **integrity** of workloads.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should enable **Network Policy** via the **Terway** plugin. A `NetworkPolicy` defines how pods communicate using label-based rules. By default, pods accept traffic from any source; NetworkPolicy restricts traffic to explicitly allowed connections, enforcing least privilege at the network level.",
+  "Risk": "Without **Network Policies**, all pods communicate freely, creating an unrestricted flat network. An attacker who compromises a single pod can move **laterally**, accessing sensitive services, databases, and secrets. The absence of network segmentation undermines **defense in depth** and increases the blast radius of any compromise, impacting **confidentiality** and **integrity** of workloads.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_private_cluster_enabled/cs_kubernetes_private_cluster_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should be configured as **private clusters** to ensure that the API server endpoint is not accessible from the public internet. In a private cluster, nodes do not have public IP addresses and all communication between nodes and the master occurs privately through **VPC peering**. This significantly reduces the attack surface by eliminating direct internet exposure of the cluster's control plane and worker nodes.",
-  "Risk": "Exposing the **API server endpoint** to the public internet increases the attack surface of the cluster, allowing attackers to probe for vulnerabilities, perform **brute force attacks** against authentication, or exploit misconfigurations. A publicly accessible API server can be targeted by automated scanning tools and botnets, increasing the risk of unauthorized access. This directly impacts the **confidentiality** and **integrity** of the cluster by potentially allowing attackers to execute commands, deploy malicious workloads, or exfiltrate sensitive data.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should be configured as **private clusters** so the API server endpoint is not publicly accessible. In a private cluster, nodes lack public IPs and all node-to-master communication occurs through **VPC peering**. This reduces the attack surface by eliminating direct internet exposure of the control plane and worker nodes.",
+  "Risk": "A public **API server endpoint** allows attackers to probe for vulnerabilities, perform **brute force attacks**, or exploit misconfigurations. Automated scanners and botnets can target it, increasing risk of unauthorized access. This impacts **confidentiality** and **integrity** by potentially allowing attackers to execute commands, deploy malicious workloads, or exfiltrate data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/cs/cs_kubernetes_rbac_enabled/cs_kubernetes_rbac_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::CS::ManagedKubernetesCluster",
   "ResourceGroup": "container",
-  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should have **Role-Based Access Control (RBAC)** enabled to enforce fine-grained authorization for cluster resources. RBAC allows administrators to define roles with specific permissions at both the cluster and namespace level, ensuring that users and service accounts only have access to the resources they need. The legacy **ABAC** (Attribute-Based Access Control) authorizer grants broad, statically defined permissions and should be disabled in favor of RBAC for improved security.",
-  "Risk": "Without **RBAC** enabled, Kubernetes clusters may rely on legacy authorization mechanisms such as **ABAC**, which grant **overly broad permissions** that cannot be scoped to specific namespaces or resource types. This increases the risk of **unauthorized access** and **privilege escalation**, where a compromised service account or user could gain access to sensitive resources across the entire cluster. The lack of granular access control directly impacts the **confidentiality** and **integrity** of workloads and secrets stored in the cluster.",
+  "Description": "**Alibaba Cloud Kubernetes Engine** clusters should have **RBAC** enabled for fine-grained authorization. RBAC lets administrators define roles with specific permissions at cluster and namespace level, ensuring users and service accounts access only needed resources. Legacy **ABAC** grants broad, static permissions and should be disabled in favor of RBAC.",
+  "Risk": "Without **RBAC**, clusters may rely on legacy **ABAC** which grants **overly broad permissions** that cannot be scoped to specific namespaces or resources. This increases the risk of **unauthorized access** and **privilege escalation**, where a compromised account could access sensitive resources across the cluster, impacting **confidentiality** and **integrity**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/ack/",

prowler/providers/alibabacloud/services/ecs/ecs_attached_disk_encrypted/ecs_attached_disk_encrypted.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::ECS::Disk",
   "ResourceGroup": "storage",
-  "Description": "**Alibaba Cloud ECS cloud disk encryption** protects data at rest by automatically encrypting data when it is transferred from ECS instances to disks and decrypting it when read. Ensuring that all attached disks are encrypted helps prevent unauthorized access to sensitive data stored on the disk. This check verifies that **disk encryption** is enabled on all ECS disks attached to instances, using **KMS** (Key Management Service) for key management.",
+  "Description": "**Alibaba Cloud ECS disk encryption** protects data at rest by automatically encrypting data transferred to disks and decrypting when read. Ensuring all attached disks are encrypted prevents unauthorized access to stored data. This check verifies **disk encryption** is enabled on all ECS disks attached to instances, using **KMS** for key management.",
   "Risk": "**Unencrypted disks** attached to ECS instances pose a significant security risk, as sensitive data could be exposed if the disk is compromised, improperly decommissioned, or accessed by unauthorized parties. Data at rest without encryption is vulnerable to **unauthorized access**, impacting **confidentiality** and potentially leading to **data breaches** or **regulatory non-compliance**.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/alibabacloud/services/ecs/ecs_instance_endpoint_protection_installed/ecs_instance_endpoint_protection_installed.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::ECS::Instance",
   "ResourceGroup": "compute",
-  "Description": "**Alibaba Cloud Security Center** provides endpoint protection for ECS instances, offering real-time detection and removal of viruses, spyware, and other malicious software. This check verifies that the **Security Center agent** is installed and active on all ECS instances, ensuring configurable alerts notify administrators when known malicious software attempts to install itself or execute on the instance.",
+  "Description": "**Alibaba Cloud Security Center** provides endpoint protection for ECS instances with real-time detection and removal of malicious software. This check verifies the **Security Center agent** is installed and active on all ECS instances, ensuring alerts notify administrators when malicious software attempts to install or execute.",
   "Risk": "ECS instances without **endpoint protection** are vulnerable to **malware**, **viruses**, **webshells**, and other security threats that can compromise **confidentiality**, **integrity**, and **availability**. Without real-time monitoring, security incidents may go undetected, allowing attackers to maintain persistent access and exfiltrate sensitive data.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/alibabacloud/services/ram/ram_no_root_access_key/ram_no_root_access_key.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "critical",
   "ResourceType": "ALIYUN::RAM::User",
   "ResourceGroup": "IAM",
-  "Description": "**Alibaba Cloud RAM** access keys provide programmatic access to a given account. The **root account** is the most privileged user in an Alibaba Cloud account and should not have access keys associated with it. It is recommended that all access keys associated with the root account be removed to limit vectors by which the account can be compromised and encourage the creation of **role-based accounts** that follow the principle of least privilege.",
-  "Risk": "The **root account** has unrestricted access to all resources and services within the Alibaba Cloud account. If access keys for the root account are compromised, an attacker gains **full administrative control** over the entire account, including the ability to create, modify, or delete any resource. This poses a critical risk to the **confidentiality**, **integrity**, and **availability** of all cloud resources and data.",
+  "Description": "**Alibaba Cloud RAM** access keys provide programmatic access to an account. The **root account** is the most privileged user and should not have access keys. All root access keys should be removed to limit compromise vectors and encourage **role-based accounts** following the principle of least privilege.",
+  "Risk": "The **root account** has unrestricted access to all resources and services. If its access keys are compromised, an attacker gains **full administrative control**, including ability to create, modify, or delete any resource. This poses critical risk to the **confidentiality**, **integrity**, and **availability** of all cloud resources and data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/102600.htm",

prowler/providers/alibabacloud/services/ram/ram_password_policy_max_password_age/ram_password_policy_max_password_age.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::RAM::SecurityPreference",
   "ResourceGroup": "IAM",
-  "Description": "**Alibaba Cloud RAM** password policies can require passwords to be expired after a given number of days. It is recommended that the password policy expire passwords after **365 days** or less to ensure periodic credential rotation. The CIS benchmark recommends an **annual password reset** as a balanced approach that avoids forcing overly frequent changes while still ensuring compromised credentials have a limited lifespan.",
-  "Risk": "Without a maximum password age policy, compromised passwords can remain valid **indefinitely**, giving attackers persistent access to cloud resources. While overly frequent password changes can encourage users to choose weak variants, a reasonable maximum age of **365 days** ensures that any compromised credentials are eventually invalidated, reducing the window of opportunity for unauthorized access and protecting the **confidentiality** and **integrity** of account data.",
+  "Description": "**Alibaba Cloud RAM** password policies can require passwords to expire after a given number of days. It is recommended to expire passwords after **365 days** or less for periodic credential rotation. The CIS benchmark recommends an **annual reset** as a balanced approach that avoids overly frequent changes while ensuring compromised credentials have a limited lifespan.",
+  "Risk": "Without a maximum password age, compromised passwords remain valid **indefinitely**, giving attackers persistent access. A reasonable maximum of **365 days** ensures compromised credentials are eventually invalidated, reducing the window for unauthorized access and protecting **confidentiality** and **integrity** of account data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/116413.htm",

prowler/providers/alibabacloud/services/ram/ram_password_policy_minimum_length/ram_password_policy_minimum_length.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "ALIYUN::RAM::SecurityPreference",
   "ResourceGroup": "IAM",
   "Description": "**Alibaba Cloud RAM** password policies can be used to enforce password complexity requirements. It is recommended that the password policy require a minimum of **14 or greater characters** for any password. Longer passwords provide exponentially more security against automated password cracking, as the keyspace increases dramatically with each additional character.",
-  "Risk": "Allowing short passwords significantly reduces the effort required for **brute force attacks** to succeed. Passwords shorter than **14 characters** can be cracked in a fraction of the time compared to longer passwords, potentially compromising the **confidentiality** of user accounts. This can lead to unauthorized access to cloud resources and sensitive data, affecting the overall **integrity** and **availability** of the environment.",
+  "Risk": "Short passwords significantly reduce the effort required for **brute force attacks**. Passwords shorter than **14 characters** can be cracked much faster, potentially compromising **confidentiality** of user accounts. This can lead to unauthorized access to cloud resources and sensitive data, affecting the **integrity** and **availability** of the environment.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/116413.htm",

prowler/providers/alibabacloud/services/ram/ram_password_policy_password_reuse_prevention/ram_password_policy_password_reuse_prevention.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "ALIYUN::RAM::SecurityPreference",
   "ResourceGroup": "IAM",
   "Description": "**Alibaba Cloud RAM** password policies can be configured to prevent the reuse of previously used passwords. It is recommended that the password policy prevent the reuse of passwords to ensure users cannot cycle back to previously compromised credentials. This increases account resiliency against **brute force logon attempts** and reduces the risk of credential reuse attacks.",
-  "Risk": "Without **password reuse prevention**, users may cycle back to previously compromised passwords. If a password was compromised in the past and is later reused, attackers with knowledge of old credentials can regain access to the account, threatening the **confidentiality** and **integrity** of cloud resources. This significantly weakens the overall security posture of the Alibaba Cloud environment.",
+  "Risk": "Without **password reuse prevention**, users may cycle back to previously compromised passwords. Attackers with knowledge of old credentials can regain access, threatening the **confidentiality** and **integrity** of cloud resources. This weakens the overall security posture of the Alibaba Cloud environment.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/116413.htm",

prowler/providers/alibabacloud/services/ram/ram_policy_attached_only_to_group_or_roles/ram_policy_attached_only_to_group_or_roles.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "low",
   "ResourceType": "ALIYUN::RAM::ManagedPolicy",
   "ResourceGroup": "IAM",
-  "Description": "**Alibaba Cloud RAM** users, groups, and roles have no access to resources by default. RAM policies are the means by which privileges are granted to users, groups, or roles. It is recommended that RAM policies be applied directly to **groups and roles** but not to individual users. This simplifies access management and reduces the likelihood of granting unintended permissions as the number of users grows.",
-  "Risk": "Assigning privileges directly to individual users instead of **groups or roles** increases the complexity of access management. As the number of users grows, this complexity can lead to principals inadvertently receiving or retaining **excessive privileges**, threatening the **confidentiality** and **integrity** of cloud resources. It also makes auditing and compliance reviews significantly more difficult.",
+  "Description": "**Alibaba Cloud RAM** users, groups, and roles have no access by default. RAM policies grant privileges to these principals. It is recommended to apply policies to **groups and roles** rather than individual users, simplifying access management and reducing unintended permissions as the number of users grows.",
+  "Risk": "Assigning privileges directly to users instead of **groups or roles** increases access management complexity. As users grow, this can lead to principals receiving **excessive privileges**, threatening **confidentiality** and **integrity** of cloud resources. It also makes auditing and compliance reviews significantly harder.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/116820.htm",

prowler/providers/alibabacloud/services/ram/ram_policy_no_administrative_privileges/ram_policy_no_administrative_privileges.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "critical",
   "ResourceType": "ALIYUN::RAM::ManagedPolicy",
   "ResourceGroup": "IAM",
-  "Description": "**Alibaba Cloud RAM** policies represent permissions that can be granted to users, groups, or roles. It is recommended to follow the principle of **least privilege** by granting only the permissions required to perform specific tasks. RAM policies with `\"Effect\": \"Allow\"`, `\"Action\": \"*\"`, and `\"Resource\": \"*\"` should be avoided as they grant full administrative access to all resources and services.",
+  "Description": "**Alibaba Cloud RAM** policies grant permissions to users, groups, or roles. Follow the principle of **least privilege** by granting only required permissions. Policies with `\"Effect\": \"Allow\"`, `\"Action\": \"*\"`, and `\"Resource\": \"*\"` should be avoided as they grant full administrative access to all resources.",
   "Risk": "RAM policies granting **full administrative privileges** (`*:*`) expose all cloud resources to potentially unwanted actions. If such a policy is attached to a compromised user, group, or role, an attacker gains unrestricted access to create, modify, or delete any resource, severely impacting the **confidentiality**, **integrity**, and **availability** of the entire Alibaba Cloud environment.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/alibabacloud/services/ram/ram_user_console_access_unused/ram_user_console_access_unused.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "ALIYUN::RAM::User",
   "ResourceGroup": "IAM",
   "Description": "**Alibaba Cloud RAM** users can log on to the console by using their username and password. If a user has not logged on for **90 days or longer**, it is recommended to disable the console access of the user. Disabling unused console access reduces the attack surface by removing unnecessary logon capabilities from potentially abandoned or dormant accounts.",
-  "Risk": "Inactive accounts with console access enabled are common targets for attackers attempting **account takeover**. An abandoned user account or one with a **compromised password** that has not been used in over 90 days may go unmonitored, allowing unauthorized access to go undetected. This poses a significant risk to the **confidentiality** and **integrity** of cloud resources accessible through the compromised account.",
+  "Risk": "Inactive accounts with console access are common targets for **account takeover**. An abandoned account or one with a **compromised password** unused for over 90 days may go unmonitored, allowing undetected unauthorized access. This risks the **confidentiality** and **integrity** of cloud resources accessible through the account.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/116820.htm",

prowler/providers/alibabacloud/services/ram/ram_user_mfa_enabled_console_access/ram_user_mfa_enabled_console_access.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "high",
   "ResourceType": "ALIYUN::RAM::User",
   "ResourceGroup": "IAM",
-  "Description": "**Alibaba Cloud RAM** supports **Multi-Factor Authentication (MFA)**, which adds an extra layer of protection on top of a username and password. With MFA enabled, when a user logs on to the console, they are prompted for their username and password followed by an authentication code from their virtual MFA device. It is recommended that MFA be enabled for all RAM users that have a console password to significantly strengthen account security.",
-  "Risk": "Without **MFA** enabled, RAM user accounts rely solely on passwords for authentication. If a password is compromised through phishing, credential stuffing, or other attacks, an attacker gains full access to the account. Enabling MFA requires an additional authentication factor, making it significantly harder for attackers to gain unauthorized access even with compromised credentials, thereby protecting the **confidentiality**, **integrity**, and **availability** of cloud resources.",
+  "Description": "**Alibaba Cloud RAM** supports **MFA**, adding protection on top of username and password. With MFA enabled, console logon requires an authentication code from a virtual MFA device after entering credentials. MFA should be enabled for all RAM users with console passwords to strengthen account security.",
+  "Risk": "Without **MFA**, RAM accounts rely solely on passwords. If compromised through phishing or credential stuffing, an attacker gains full account access. MFA requires an additional factor, making unauthorized access significantly harder even with compromised credentials, protecting **confidentiality**, **integrity**, and **availability** of cloud resources.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/119555.htm",

prowler/providers/alibabacloud/services/rds/rds_instance_sql_audit_enabled/rds_instance_sql_audit_enabled.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::RDS::DBInstance",
   "ResourceGroup": "database",
-  "Description": "**Alibaba Cloud RDS instances** should have **SQL auditing** (SQL Explorer) enabled to track database events and write them to an audit log. SQL auditing helps maintain **regulatory compliance**, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations. This applies to all RDS engine types except SQL Server 2012/2016/2017 and MariaDB TX.",
+  "Description": "**Alibaba Cloud RDS instances** should have **SQL auditing** (SQL Explorer) enabled to track database events in an audit log. This helps maintain **regulatory compliance**, understand database activity, and detect anomalies indicating security violations. Applies to all RDS engines except SQL Server 2012/2016/2017 and MariaDB TX.",
   "Risk": "Without **SQL auditing**, it is difficult to detect **unauthorized access**, **data breaches**, or **malicious activity** within the database. The absence of audit logs hinders **forensic investigations**, compliance reporting, and the ability to identify **data exfiltration** or **privilege escalation** attempts, impacting **confidentiality** and **integrity**.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/alibabacloud/services/sls/sls_cloud_firewall_changes_alert_enabled/sls_cloud_firewall_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a metric filter and alarm configured for **Cloud Firewall** rule changes. By directing **ActionTrail** logs to SLS and establishing corresponding query and alert rules, real-time monitoring of firewall modifications can be achieved. This ensures that any creation, update, or deletion of Cloud Firewall control policies is promptly detected and reviewed.",
-  "Risk": "Without monitoring for **Cloud Firewall** changes, unauthorized or accidental modifications to firewall rules may go undetected. This could lead to **network exposure**, allowing malicious traffic to reach protected resources or blocking legitimate traffic. Failure to detect firewall rule changes in a timely manner increases the risk of **data breaches**, **lateral movement**, and **service disruption**.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **Cloud Firewall** rule changes. By directing **ActionTrail** logs to SLS with alert rules, real-time monitoring of firewall modifications is achieved. This ensures creation, update, or deletion of Cloud Firewall control policies is promptly detected and reviewed.",
+  "Risk": "Without monitoring for **Cloud Firewall** changes, unauthorized modifications to firewall rules may go undetected, leading to **network exposure** or blocked legitimate traffic. Failure to detect changes timely increases risk of **data breaches**, **lateral movement**, and **service disruption**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_customer_created_cmk_changes_alert_enabled/sls_customer_created_cmk_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for customer-created **KMS Customer Master Keys (CMKs)** that have changed state to disabled or scheduled for deletion. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that any disabling or deletion of encryption keys is promptly detected, preventing accidental or malicious loss of access to encrypted data.",
-  "Risk": "Without monitoring for **CMK state changes**, data encrypted with **disabled or deleted keys** will become permanently inaccessible. This could lead to **data loss**, **business disruption**, and **compliance violations**. Malicious actors who gain access to the KMS service could silently disable or schedule deletion of critical encryption keys, rendering protected data unrecoverable if not detected in time.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for customer-created **KMS CMKs** that are disabled or scheduled for deletion. By directing **ActionTrail** logs to SLS with alert rules, disabling or deletion of encryption keys is promptly detected, preventing accidental or malicious loss of access to encrypted data.",
+  "Risk": "Without monitoring for **CMK state changes**, data encrypted with **disabled or deleted keys** becomes permanently inaccessible, leading to **data loss**, **business disruption**, and **compliance violations**. Malicious actors could silently disable or schedule deletion of encryption keys, rendering data unrecoverable.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_logstore_retention_period/sls_logstore_retention_period.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "ALIYUN::SLS::Logstore",
   "ResourceGroup": "monitoring",
   "Description": "**Alibaba Cloud Simple Log Service (SLS)** Logstore data retention should be configured for at least **365 days**. The Logstore retention period controls how long activity logs are stored and available for analysis. Ensuring a minimum retention of `365` days provides sufficient time to investigate security incidents, perform forensic analysis, and meet regulatory compliance requirements.",
-  "Risk": "Insufficient log retention periods may result in the **loss of forensic evidence** needed for security investigations and incident response. If logs are deleted before an incident is detected, it becomes impossible to determine the scope, impact, and root cause of security breaches. Short retention periods may also lead to **compliance violations** with regulations that mandate specific log retention durations, affecting the organization's **integrity** and **accountability**.",
+  "Risk": "Insufficient log retention may result in **loss of forensic evidence** for security investigations. If logs are deleted before an incident is detected, determining the scope and root cause of breaches becomes impossible. Short retention may also cause **compliance violations** with regulations mandating specific durations, affecting **integrity** and **accountability**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/48990.htm",

prowler/providers/alibabacloud/services/sls/sls_management_console_authentication_failures_alert_enabled/sls_management_console_authentication_failures_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for **failed console authentication attempts**. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that repeated login failures are detected promptly, enabling early identification of brute-force attacks or credential stuffing attempts against the Management Console.",
-  "Risk": "Without monitoring for **failed console authentication attempts**, brute-force attacks and credential stuffing campaigns may go undetected. Failure to identify these patterns increases the risk of **unauthorized access** to the Management Console. Monitoring failed logins provides critical indicators such as source IP addresses that can be used for **threat correlation** and proactive blocking, reducing the time to detect and respond to **account compromise** attempts.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **failed console authentication attempts**. By directing **ActionTrail** logs to SLS with alert rules, repeated login failures are detected promptly, enabling early identification of brute-force or credential stuffing attacks against the Management Console.",
+  "Risk": "Without monitoring for **failed console authentication**, brute-force and credential stuffing attacks may go undetected, increasing the risk of **unauthorized access**. Failed login monitoring provides source IP indicators for **threat correlation** and proactive blocking, reducing time to detect and respond to **account compromise** attempts.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_management_console_signin_without_mfa_alert_enabled/sls_management_console_signin_without_mfa_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for console logins that are not protected by **multi-factor authentication (MFA)**. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that any single-factor console sign-in events are detected, helping identify accounts that bypass MFA enforcement policies.",
-  "Risk": "Without monitoring for **single-factor console logins**, accounts that are not protected by MFA may go unnoticed. This increases the risk of **unauthorized access** through compromised credentials, as passwords alone are insufficient to prevent account takeover. Failure to enforce and monitor MFA compliance weakens the overall **authentication posture** and may lead to **privilege escalation** or **data breaches** if an attacker gains access to an unprotected account.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for console logins not protected by **MFA**. By directing **ActionTrail** logs to SLS with alert rules, single-factor console sign-in events are detected, helping identify accounts that bypass MFA enforcement policies.",
+  "Risk": "Without monitoring for **single-factor logins**, accounts not protected by MFA may go unnoticed, increasing risk of **unauthorized access** through compromised credentials. Failure to monitor MFA compliance weakens **authentication posture** and may lead to **privilege escalation** or **data breaches** if an attacker accesses an unprotected account.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_oss_bucket_policy_changes_alert_enabled/sls_oss_bucket_policy_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for changes to **OSS bucket policies**. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that any modifications to bucket access policies are detected promptly, enabling quick identification of potentially dangerous permission changes on sensitive storage resources.",
-  "Risk": "Without monitoring for **OSS bucket policy changes**, permissive or malicious policy modifications may go undetected. This could lead to **unintended data exposure**, allowing unauthorized users to access, modify, or delete sensitive objects stored in OSS buckets. Delayed detection of policy changes increases the risk of **data breaches**, **data exfiltration**, and **compliance violations**, as attackers could silently widen access to critical storage resources.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **OSS bucket policy** changes. By directing **ActionTrail** logs to SLS with alert rules, modifications to bucket access policies are detected promptly, enabling quick identification of dangerous permission changes on sensitive storage resources.",
+  "Risk": "Without monitoring for **OSS bucket policy changes**, malicious modifications may go undetected, leading to **unintended data exposure**. Unauthorized users could access or delete sensitive objects. Delayed detection increases risk of **data breaches**, **data exfiltration**, and **compliance violations** as attackers silently widen access to storage resources.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_oss_permission_changes_alert_enabled/sls_oss_permission_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a metric filter and alarm configured for **OSS Bucket RAM** permission changes. By directing **ActionTrail** logs to SLS and establishing corresponding alert rules, real-time monitoring of OSS permission modifications can be achieved. This ensures that changes to bucket-level access controls and RAM policies affecting OSS resources are promptly detected and reviewed.",
-  "Risk": "Without monitoring for **OSS permission changes**, unauthorized modifications to bucket access controls may go undetected. This could allow attackers to grant themselves or others **unauthorized access** to sensitive objects stored in OSS buckets. Delayed detection of permission changes increases the risk of **data exfiltration**, **data tampering**, and **compliance violations**, as the confidentiality and integrity of stored data may be compromised.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **OSS Bucket RAM** permission changes. By directing **ActionTrail** logs to SLS with alert rules, OSS permission modifications are monitored in real time. This ensures changes to bucket access controls and RAM policies affecting OSS are promptly detected.",
+  "Risk": "Without monitoring for **OSS permission changes**, unauthorized modifications to bucket access controls may go undetected, allowing attackers **unauthorized access** to sensitive objects. Delayed detection increases risk of **data exfiltration**, **data tampering**, and **compliance violations**, compromising confidentiality and integrity of stored data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_ram_role_changes_alert_enabled/sls_ram_role_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for **RAM Role** creation, deletion, and updating activities. By directing **ActionTrail** logs to SLS and establishing corresponding alert rules, real-time monitoring of role changes can be achieved. This ensures that any modifications to RAM roles are detected promptly, enabling early identification of unauthorized privilege escalation attempts.",
-  "Risk": "Without monitoring for **RAM role changes**, unauthorized creation, modification, or deletion of roles may go undetected. This could lead to **privilege escalation**, where an attacker creates or modifies roles to gain elevated access to cloud resources. Undetected role changes compromise the **integrity** of the identity and access management framework and may result in **unauthorized access** to sensitive data and services across the entire cloud environment.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **RAM Role** creation, deletion, and update activities. By directing **ActionTrail** logs to SLS with alert rules, role changes are monitored in real time. This ensures RAM role modifications are detected promptly, enabling early identification of unauthorized privilege escalation.",
+  "Risk": "Without monitoring for **RAM role changes**, unauthorized creation, modification, or deletion of roles may go undetected, enabling **privilege escalation** where attackers gain elevated access. Undetected role changes compromise IAM **integrity** and may result in **unauthorized access** to sensitive data and services across the cloud environment.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_rds_instance_configuration_changes_alert_enabled/sls_rds_instance_configuration_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a metric filter and alarm configured for **RDS Instance** configuration changes. By directing **ActionTrail** logs to SLS and establishing corresponding alert rules, real-time monitoring of database configuration modifications can be achieved. This ensures that any changes to RDS instance settings, such as security parameters, network configurations, or access controls, are promptly detected and reviewed.",
-  "Risk": "Without monitoring for **RDS Instance configuration changes**, unauthorized or accidental modifications to database servers may go undetected. This could lead to **security misconfigurations** such as enabling public access, disabling encryption, or weakening authentication settings. Delayed detection of configuration changes increases the risk of **data breaches**, **unauthorized database access**, and **service disruption**, potentially compromising the **confidentiality** and **integrity** of stored data.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **RDS Instance** configuration changes. By directing **ActionTrail** logs to SLS with alert rules, database configuration modifications are monitored in real time. This ensures changes to security parameters, network settings, or access controls are promptly detected.",
+  "Risk": "Without monitoring for **RDS configuration changes**, unauthorized modifications may go undetected, leading to **security misconfigurations** such as enabling public access or disabling encryption. Delayed detection increases risk of **data breaches**, **unauthorized database access**, and **service disruption**, compromising **confidentiality** and **integrity** of stored data.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_root_account_usage_alert_enabled/sls_root_account_usage_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for **root account login** attempts. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that any usage of the fully privileged root account is detected promptly, supporting the principle of least privilege and enabling timely review of root-level operations.",
-  "Risk": "Without monitoring for **root account usage**, activities performed by the most privileged account may go unnoticed. The root account has unrestricted access to all resources and services, making it a high-value target for attackers. Failure to detect unauthorized root account usage increases the risk of **complete account takeover**, **data destruction**, and **irreversible configuration changes** that could compromise the **confidentiality**, **integrity**, and **availability** of all cloud resources.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **root account login** attempts. By directing **ActionTrail** logs to SLS with alert rules, usage of the fully privileged root account is detected promptly, supporting least privilege and enabling timely review of root-level operations.",
+  "Risk": "Without monitoring for **root account usage**, activities by the most privileged account may go unnoticed. The root account has unrestricted access to all resources, making it a high-value target. Failure to detect unauthorized usage increases risk of **account takeover**, **data destruction**, and **irreversible changes** compromising **confidentiality**, **integrity**, and **availability**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_security_group_changes_alert_enabled/sls_security_group_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for changes to **Security Groups**. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. **Security Groups** are stateful packet filters that control ingress and egress traffic within a VPC, and monitoring their changes ensures that network access modifications are promptly detected and reviewed.",
-  "Risk": "Without monitoring for **security group changes**, unauthorized modifications to network access controls may go undetected. This could lead to resources and services being **unintentionally exposed** to the internet or untrusted networks. Unauthorized security group modifications increase the risk of **network exposure**, **unauthorized access**, and **lateral movement** within the cloud environment, potentially compromising the **confidentiality** and **availability** of critical services.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **Security Group** changes. By directing **ActionTrail** logs to SLS with alert rules, real-time monitoring is achieved. **Security Groups** are stateful packet filters controlling VPC ingress and egress traffic; monitoring their changes ensures network access modifications are promptly detected.",
+  "Risk": "Without monitoring for **security group changes**, unauthorized modifications to network access controls may go undetected, leading to resources being **exposed** to untrusted networks. This increases risk of **network exposure**, **unauthorized access**, and **lateral movement**, potentially compromising **confidentiality** and **availability** of critical services.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_unauthorized_api_calls_alert_enabled/sls_unauthorized_api_calls_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a query and alarm configured for **unauthorized API calls**. Real-time monitoring of API calls can be achieved by directing **ActionTrail** logs to SLS and establishing corresponding alert rules. This ensures that any API calls resulting in unauthorized errors are detected promptly, helping identify misconfigured applications, compromised credentials, or active reconnaissance by attackers.",
-  "Risk": "Without monitoring for **unauthorized API calls**, patterns of failed access attempts may go undetected. These patterns often indicate **malicious activity** such as attackers probing for permissions or attempting to exploit misconfigured access controls. Failure to detect unauthorized API calls in a timely manner increases the risk of **security breaches**, as it delays identification of compromised credentials and **privilege escalation** attempts across cloud services.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **unauthorized API calls**. By directing **ActionTrail** logs to SLS with alert rules, API calls resulting in unauthorized errors are detected promptly, helping identify misconfigured applications, compromised credentials, or active attacker reconnaissance.",
+  "Risk": "Without monitoring for **unauthorized API calls**, failed access patterns may go undetected. These often indicate **malicious activity** such as permission probing or exploiting misconfigured access controls. Delayed detection increases risk of **security breaches** by delaying identification of compromised credentials and **privilege escalation** attempts.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_vpc_changes_alert_enabled/sls_vpc_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a log search/analysis query and alarm configured for **VPC** changes. By directing **ActionTrail** logs to SLS and establishing corresponding alert rules, real-time monitoring of VPC modifications can be achieved. This ensures that any creation, deletion, or modification of VPCs and their associated components is promptly detected and reviewed.",
-  "Risk": "Without monitoring for **VPC changes**, unauthorized or accidental modifications to virtual network infrastructure may go undetected. This could disrupt **network connectivity**, create **security vulnerabilities**, or expose internal resources to untrusted networks. Unauthorized VPC modifications increase the risk of **service disruption**, **data interception**, and **lateral movement** within the cloud environment, potentially compromising the **confidentiality** and **availability** of all connected resources.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **VPC** changes. By directing **ActionTrail** logs to SLS with alert rules, VPC modifications are monitored in real time. This ensures creation, deletion, or modification of VPCs and associated components is promptly detected.",
+  "Risk": "Without monitoring for **VPC changes**, unauthorized modifications to network infrastructure may go undetected, disrupting **connectivity**, creating **vulnerabilities**, or exposing internal resources. This increases risk of **service disruption**, **data interception**, and **lateral movement**, compromising **confidentiality** and **availability** of connected resources.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/alibabacloud/services/sls/sls_vpc_network_route_changes_alert_enabled/sls_vpc_network_route_changes_alert_enabled.metadata.json

@@ -9,8 +9,8 @@
   "Severity": "medium",
   "ResourceType": "ALIYUN::SLS::Alert",
   "ResourceGroup": "monitoring",
-  "Description": "**Alibaba Cloud Simple Log Service (SLS)** should have a metric filter and alarm configured for **VPC network route** changes. By directing **ActionTrail** logs to SLS and establishing corresponding alert rules, real-time monitoring of route table modifications can be achieved. This ensures that any creation, deletion, or modification of route entries is promptly detected, helping verify that all VPC traffic flows through the expected network paths.",
-  "Risk": "Without monitoring for **route table changes**, unauthorized modifications to network routes may go undetected. This could allow attackers to redirect traffic through **malicious intermediaries** for interception or manipulation. Undetected route changes increase the risk of **man-in-the-middle attacks**, **data exfiltration**, and **service disruption**, as traffic may be silently diverted away from intended destinations, compromising the **confidentiality** and **integrity** of data in transit.",
+  "Description": "**Alibaba Cloud SLS** should have an alarm configured for **VPC network route** changes. By directing **ActionTrail** logs to SLS with alert rules, route table modifications are monitored in real time. This ensures creation, deletion, or modification of route entries is detected, verifying VPC traffic flows through expected paths.",
+  "Risk": "Without monitoring for **route table changes**, unauthorized route modifications may go undetected, allowing attackers to redirect traffic through **malicious intermediaries**. This increases risk of **man-in-the-middle attacks**, **data exfiltration**, and **service disruption** as traffic is diverted from intended destinations, compromising **confidentiality** and **integrity**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.alibabacloud.com/help/en/doc-detail/91784.htm",

prowler/providers/aws/config/check_types.json

@@ -0,0 +1,88 @@
+{
+  "Software and Configuration Checks": {
+    "Vulnerabilities": {
+      "CVE": {}
+    },
+    "AWS Security Best Practices": {
+      "Network Reachability": {},
+      "Network Security": {},
+      "Runtime Behavior Analysis": {},
+      "Data Encryption": {},
+      "Encryption at Rest": {},
+      "Encryption in Transit": {}
+    },
+    "Industry and Regulatory Standards": {
+      "AWS Foundational Security Best Practices": {},
+      "CIS Host Hardening Benchmarks": {},
+      "CIS AWS Foundations Benchmark": {},
+      "PCI-DSS": {},
+      "Cloud Security Alliance Controls": {},
+      "ISO 90001 Controls": {},
+      "ISO 27001 Controls": {},
+      "ISO 27017 Controls": {},
+      "ISO 27018 Controls": {},
+      "SOC 1": {},
+      "SOC 2": {},
+      "HIPAA Controls (USA)": {},
+      "NIST 800-53 Controls": {},
+      "NIST 800-53 Controls (USA)": {},
+      "NIST CSF Controls (USA)": {},
+      "IRAP Controls (Australia)": {},
+      "K-ISMS Controls (Korea)": {},
+      "MTCS Controls (Singapore)": {},
+      "FISC Controls (Japan)": {},
+      "My Number Act Controls (Japan)": {},
+      "ENS Controls (Spain)": {},
+      "Cyber Essentials Plus Controls (UK)": {},
+      "G-Cloud Controls (UK)": {},
+      "C5 Controls (Germany)": {},
+      "IT-Grundschutz Controls (Germany)": {},
+      "GDPR Controls (Europe)": {},
+      "TISAX Controls (Europe)": {}
+    },
+    "Patch Management": {}
+  },
+  "TTPs": {
+    "Initial Access": {
+      "Unauthorized Access": {},
+      "External Remote Services": {},
+      "Valid Accounts": {}
+    },
+    "Execution": {},
+    "Persistence": {},
+    "Privilege Escalation": {},
+    "Defense Evasion": {},
+    "Credential Access": {},
+    "Discovery": {},
+    "Lateral Movement": {},
+    "Collection": {},
+    "Command and Control": {}
+  },
+  "Effects": {
+    "Data Exposure": {},
+    "Data Exfiltration": {},
+    "Data Destruction": {},
+    "Denial of Service": {},
+    "Resource Consumption": {}
+  },
+  "Unusual Behaviors": {
+    "Application": {},
+    "Network Flow": {},
+    "IP address": {},
+    "User": {},
+    "VM": {},
+    "Container": {},
+    "Serverless": {},
+    "Process": {},
+    "Database": {},
+    "Data": {}
+  },
+  "Sensitive Data Identifications": {
+    "PII": {},
+    "Passwords": {},
+    "Legal": {},
+    "Financial": {},
+    "Security": {},
+    "Business": {}
+  }
+}

prowler/providers/aws/services/cloudtrail/cloudtrail_logs_s3_bucket_is_not_publicly_accessible/cloudtrail_logs_s3_bucket_is_not_publicly_accessible.metadata.json

@@ -4,8 +4,8 @@
   "CheckTitle": "CloudTrail trail S3 bucket is not publicly accessible",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
-    "Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
     "Effects/Data Exposure"
   ],
   "ServiceName": "cloudtrail",

prowler/providers/aws/services/cloudwatch/cloudwatch_alarm_actions_enabled/cloudwatch_alarm_actions_enabled.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "CloudWatch metric alarm has actions enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Defense Evasion"
   ],
   "ServiceName": "cloudwatch",

prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.metadata.json

@@ -12,7 +12,7 @@
   "ResourceType": "AwsCodePipelinePipeline",
   "ResourceGroup": "devops",
   "Description": "**CodePipeline pipeline** should configure its **source stage** to use a **private repository** with authenticated connection rather than a public GitHub or GitLab repository. This ensures deployment configurations, build artifacts, and CI/CD logic remain protected from unauthorized access.",
-  "Risk": "Using **public repositories** as pipeline sources exposes deployment configurations, infrastructure code, and CI/CD workflows to anyone on the internet. \n\nThis increases the risk of **supply chain attacks**, **credential exposure**, and **intellectual property theft**. Adversaries can study deployment patterns, identify security gaps, inject malicious code, or leverage exposed secrets to compromise **confidentiality**, **integrity**, and **availability** of production systems.",
+  "Risk": "Using **public repositories** as pipeline sources exposes deployment configurations and CI/CD workflows to the internet, increasing risk of **supply chain attacks**, **credential exposure**, and **intellectual property theft**. Adversaries can inject malicious code or leverage exposed secrets to compromise production systems.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome.html",
@@ -31,8 +31,8 @@
     }
   },
   "Categories": [
-    "supply-chain-security",
-    "secrets-management"
+    "software-supply-chain",
+    "secrets"
   ],
   "DependsOn": [],
   "RelatedTo": [],

prowler/providers/aws/services/cognito/cognito_user_pool_waf_acl_attached/cognito_user_pool_waf_acl_attached.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Amazon Cognito user pool is associated with a WAF Web ACL",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Denial of Service"
   ],
   "ServiceName": "cognito",

prowler/providers/aws/services/directoryservice/directoryservice_supported_mfa_radius_enabled/directoryservice_supported_mfa_radius_enabled.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "AWS Directory Service directory has RADIUS-based MFA enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Initial Access",
     "TTPs/Credential Access"
   ],

prowler/providers/aws/services/documentdb/documentdb_cluster_backup_enabled/documentdb_cluster_backup_enabled.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "DocumentDB cluster has automated backups enabled with retention period of at least 7 days",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Data Destruction"
   ],
   "ServiceName": "documentdb",

prowler/providers/aws/services/ec2/ec2_instance_port_mysql_exposed_to_internet/ec2_instance_port_mysql_exposed_to_internet.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "EC2 instance does not allow ingress from the Internet to TCP port 3306 (MySQL)",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Initial Access/Unauthorized Access",
     "Effects/Data Exposure"
   ],

prowler/providers/aws/services/ec2/ec2_networkacl_unused/ec2_networkacl_unused.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Non-default network ACL is associated with a subnet",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "ec2",
   "SubServiceName": "",

prowler/providers/aws/services/elasticache/elasticache_cluster_uses_public_subnet/elasticache_cluster_uses_public_subnet.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "ElastiCache cluster is not using public subnets",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Data Exposure"
   ],
   "ServiceName": "elasticache",

prowler/providers/aws/services/eventbridge/eventbridge_bus_cross_account_access/eventbridge_bus_cross_account_access.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "AWS EventBridge event bus does not allow cross-account access",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Initial Access/Unauthorized Access",
     "Effects/Data Exposure"
   ],

prowler/providers/aws/services/guardduty/guardduty_delegated_admin_enabled_all_regions/guardduty_delegated_admin_enabled_all_regions.metadata.json

@@ -13,7 +13,7 @@
   "ResourceType": "AwsGuardDutyDetector",
   "ResourceGroup": "security",
   "Description": "**Amazon GuardDuty** has a delegated administrator configured at the organization level, detectors are enabled in all opted-in regions, and organization auto-enable is active for new member accounts.",
-  "Risk": "Without org-wide **Amazon GuardDuty** configuration, gaps can occur where **GuardDuty** may be enabled in some regions but not others. Delegated admin may not be set consistently, and new accounts may not be automatically enrolled. This fragments **threat visibility**, delays **incident response**, and allows adversaries to exploit unmonitored regions or accounts for **lateral movement**, **persistence**, and **data exfiltration**.",
+  "Risk": "Without org-wide **Amazon GuardDuty** configuration, gaps can occur where detectors are enabled in some regions but not others, delegated admin is inconsistent, and new accounts are not auto-enrolled. This fragments **threat visibility**, delays **incident response**, and allows adversaries to exploit unmonitored regions or accounts for **lateral movement** and **data exfiltration**.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html",

prowler/providers/aws/services/iam/iam_aws_attached_policy_no_administrative_privileges/iam_aws_attached_policy_no_administrative_privileges.metadata.json

@@ -4,8 +4,8 @@
   "CheckTitle": "Attached AWS-managed IAM policy does not allow '*:*' administrative privileges",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
-    "Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
     "TTPs/Privilege Escalation"
   ],
   "ServiceName": "iam",

prowler/providers/aws/services/iam/iam_inline_policy_no_full_access_to_kms/iam_inline_policy_no_full_access_to_kms.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Inline IAM policy does not allow kms:* privileges",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Privilege Escalation",
     "Effects/Data Exposure"
   ],

prowler/providers/aws/services/iam/iam_user_with_temporary_credentials/iam_user_with_temporary_credentials.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "IAM user does not use long-lived credentials to access services other than IAM or STS",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Credential Access"
   ],
   "ServiceName": "iam",

prowler/providers/aws/services/inspector2/inspector2_active_findings_exist/inspector2_active_findings_exist.metadata.json

@@ -9,7 +9,7 @@
     "Software and Configuration Checks/Vulnerabilities/CVE",
     "Software and Configuration Checks/Patch Management",
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "inspector2",
   "SubServiceName": "",

prowler/providers/aws/services/kafka/kafka_cluster_encryption_at_rest_uses_cmk/kafka_cluster_encryption_at_rest_uses_cmk.metadata.json

@@ -4,9 +4,9 @@
   "CheckTitle": "Kafka cluster has encryption at rest enabled with a customer managed key (CMK) or is serverless",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Data Encryption",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
-    "Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
-    "Industry and Regulatory Standards/PCI-DSS",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)",
+    "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS",
     "Effects/Data Exposure"
   ],
   "ServiceName": "kafka",

prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Cloud KMS key does not grant access to allUsers or allAuthenticatedUsers",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Initial Access/Unauthorized Access",
     "Effects/Data Exposure"
   ],

prowler/providers/aws/services/neptune/neptune_cluster_deletion_protection/neptune_cluster_deletion_protection.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Neptune cluster has deletion protection enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Data Destruction"
   ],
   "ServiceName": "neptune",

prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "RDS cluster has Multi-AZ enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
   ],
   "ServiceName": "rds",
   "SubServiceName": "",

prowler/providers/aws/services/s3/s3_bucket_object_versioning/s3_bucket_object_versioning.metadata.json

@@ -4,8 +4,8 @@
   "CheckTitle": "S3 bucket has object versioning enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
-    "Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
     "Effects/Data Destruction"
   ],
   "ServiceName": "s3",

prowler/providers/aws/services/sagemaker/sagemaker_training_jobs_intercontainer_encryption_enabled/sagemaker_training_jobs_intercontainer_encryption_enabled.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Amazon SageMaker training job has inter-container traffic encryption enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Security",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Data Exposure"
   ],
   "ServiceName": "sagemaker",

prowler/providers/aws/services/shield/shield_advanced_protection_in_associated_elastic_ips/shield_advanced_protection_in_associated_elastic_ips.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "Elastic IP address is protected by AWS Shield Advanced",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices/Network Reachability",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Denial of Service"
   ],
   "ServiceName": "shield",

prowler/providers/aws/services/sqs/sqs_queues_server_side_encryption_enabled/sqs_queues_server_side_encryption_enabled.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "SQS queue has server-side encryption enabled",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "Effects/Data Exposure"
   ],
   "ServiceName": "sqs",

prowler/providers/aws/services/vpc/vpc_endpoint_connections_trust_boundaries/vpc_endpoint_connections_trust_boundaries.metadata.json

@@ -4,7 +4,7 @@
   "CheckTitle": "VPC endpoint policy allows access only from trusted AWS accounts",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
-    "Industry and Regulatory Standards/AWS Foundational Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
     "TTPs/Initial Access"
   ],
   "ServiceName": "vpc",

prowler/providers/azure/services/entra/entra_conditional_access_policy_require_mfa_for_management_api/entra_conditional_access_policy_require_mfa_for_management_api.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "azure",
   "CheckID": "entra_conditional_access_policy_require_mfa_for_management_api",
-  "CheckTitle": "Ensure Multifactor Authentication is Required for Windows Azure Service Management API",
+  "CheckTitle": "Multifactor Authentication is required for Windows Azure Service Management API",
   "CheckType": [],
   "ServiceName": "entra",
   "SubServiceName": "",
@@ -11,7 +11,7 @@
   "ResourceGroup": "IAM",
   "Description": "This recommendation ensures that users accessing the Windows Azure Service Management API (i.e. Azure Powershell, Azure CLI, Azure Resource Manager API, etc.) are required to use multifactor authentication (MFA) credentials when accessing resources through the Windows Azure Service Management API.",
   "Risk": "Administrative access to the Windows Azure Service Management API should be secured with a higher level of scrutiny to authenticating mechanisms. Enabling multifactor authentication is recommended to reduce the potential for abuse of Administrative actions, and to prevent intruders or compromised admin credentials from changing administrative settings.",
-  "RelatedUrl": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-azure-management",
+  "RelatedUrl": "",
   "Remediation": {
     "Code": {
       "CLI": "",
@@ -21,7 +21,7 @@
     },
     "Recommendation": {
       "Text": "1. From the Azure Admin Portal dashboard, open Microsoft Entra ID. 2. Click Security in the Entra ID blade. 3. Click Conditional Access in the Security blade. 4. Click Policies in the Conditional Access blade. 5. Click + New policy. 6. Enter a name for the policy. 7. Click the blue text under Users. 8. Under Include, select All users. 9. Under Exclude, check Users and groups. 10. Select users or groups to be exempted from this policy (e.g. break-glass emergency accounts, and non-interactive service accounts) then click the Select button. 11. Click the blue text under Target Resources. 12. Under Include, click the Select apps radio button. 13. Click the blue text under Select. 14. Check the box next to Windows Azure Service Management APIs then click the Select button. 15. Click the blue text under Grant. 16. Under Grant access check the box for Require multifactor authentication then click the Select button. 17. Before creating, set Enable policy to Report-only. 18. Click Create. After testing the policy in report-only mode, update the Enable policy setting from Report-only to On.",
-      "Url": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps"
+      "Url": "https://hub.prowler.com/check/entra_conditional_access_policy_require_mfa_for_management_api"
     }
   },
   "Categories": [

prowler/providers/cloudflare/services/dns/dns_record_cname_target_valid/dns_record_cname_target_valid.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "DNSRecord",
   "ResourceGroup": "network",
   "Description": "**Cloudflare DNS records** (CNAME, MX, NS, SRV) that point to hostnames are assessed for **dangling record** vulnerabilities by checking if the target domain resolves to a valid address, preventing **subdomain takeover**, **mail interception**, and **service hijacking** attacks.",
-  "Risk": "Dangling **DNS records** pointing to non-existent targets create multiple vulnerabilities.\n- **Confidentiality**: dangling CNAME/NS allows subdomain takeover; dangling MX allows mail interception\n- **Integrity**: attackers can impersonate your organization, intercept emails, or hijack services\n- **Availability**: legitimate services may be disrupted or redirected to attacker-controlled infrastructure",
+  "Risk": "Dangling **DNS records** pointing to non-existent targets create multiple vulnerabilities. Dangling CNAME/NS allows **subdomain takeover**; dangling MX allows **mail interception**. Attackers can impersonate your organization, hijack services, or redirect legitimate traffic to attacker-controlled infrastructure.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/"

prowler/providers/cloudflare/services/zone/zone_record_caa_exists/zone_record_caa_exists.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "Zone",
   "ResourceGroup": "network",
   "Description": "**Cloudflare zones** are assessed for **CAA (Certificate Authority Authorization)** DNS records by checking if they exist with **`issue` or `issuewild` tags** that specify which **certificate authorities** are permitted to issue SSL/TLS certificates for the domain.",
-  "Risk": "Without **CAA** records or without `issue`/`issuewild` tags, any certificate authority can issue certificates for your domain.\n- **Confidentiality**: unauthorized certificates enable man-in-the-middle attacks\n- **Integrity**: attackers can impersonate your domain with fraudulently obtained certificates\n- **Trust**: CA compromise or social engineering can result in unauthorized certificate issuance\n- **Missing tags**: CAA records without `issue` or `issuewild` tags (e.g., only `iodef`) do not restrict certificate issuance",
+  "Risk": "Without **CAA** records or `issue`/`issuewild` tags, any certificate authority can issue certificates for your domain. Unauthorized certificates enable **man-in-the-middle attacks** and domain impersonation. CAA records with only `iodef` tags do not restrict certificate issuance.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/ssl/edge-certificates/caa-records/"

prowler/providers/cloudflare/services/zone/zone_record_dkim_exists/zone_record_dkim_exists.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "Zone",
   "ResourceGroup": "network",
   "Description": "**Cloudflare zones** are assessed for **DKIM (DomainKeys Identified Mail)** records by checking if TXT records exist at `*._domainkey` subdomains containing a **cryptographically valid public key** in the `p=` parameter used to **verify email signatures**.",
-  "Risk": "Without **DKIM** or with a revoked/empty public key, email recipients cannot verify that messages were sent by authorized servers.\n- **Confidentiality**: attackers can forge emails appearing to come from your domain\n- **Integrity**: no cryptographic proof that email content hasn't been modified in transit\n- **Reputation**: DMARC policies relying on DKIM will fail, affecting email deliverability\n- **Revoked keys**: A DKIM record with `p=` empty (e.g., `p=;`) indicates a revoked key that cannot authenticate emails",
+  "Risk": "Without **DKIM** or with a revoked/empty public key, recipients cannot verify messages were sent by authorized servers. Attackers can forge emails from your domain, and content integrity cannot be proven. DMARC policies relying on DKIM will fail, affecting deliverability. A DKIM record with empty `p=` indicates a revoked key.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/"

prowler/providers/cloudflare/services/zone/zone_record_dmarc_exists/zone_record_dmarc_exists.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "Zone",
   "ResourceGroup": "network",
   "Description": "**Cloudflare zones** are assessed for **DMARC (Domain-based Message Authentication, Reporting, and Conformance)** records by checking if a TXT record exists at `_dmarc` subdomain with an **enforcement policy (`p=reject` or `p=quarantine`)** to actively block or quarantine spoofed emails.",
-  "Risk": "Without **DMARC** or with a monitoring-only policy (`p=none`), there is no active protection against email spoofing.\n- **Confidentiality**: attackers can spoof emails for phishing campaigns to steal credentials\n- **Integrity**: no visibility into email authentication failures or abuse attempts\n- **Reputation**: domain reputation damage from spoofed emails sent in your name\n- **Monitoring-only policy**: `p=none` only generates reports but does not block or quarantine spoofed emails, providing no real protection",
+  "Risk": "Without **DMARC** or with `p=none`, there is no active protection against email spoofing. Attackers can spoof emails for **phishing campaigns** to steal credentials. Domain reputation is damaged by spoofed emails. The `p=none` policy only generates reports but does not block or quarantine spoofed emails.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/"

prowler/providers/cloudflare/services/zone/zone_record_spf_exists/zone_record_spf_exists.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "Zone",
   "ResourceGroup": "network",
   "Description": "**Cloudflare zones** are assessed for **SPF (Sender Policy Framework)** records by checking if a TXT record exists that specifies which mail servers are **authorized to send email** on behalf of the domain, and verifies that the record uses a **strict policy (`-all`)** to reject unauthorized senders.",
-  "Risk": "Without **SPF** or with a permissive policy (`~all`, `?all`, `+all`), attackers can forge emails appearing to come from your domain.\n- **Confidentiality**: phishing attacks can harvest sensitive information from recipients who trust spoofed emails\n- **Integrity**: brand reputation damage from fraudulent emails sent in your name\n- **Availability**: email deliverability issues as receiving servers may reject or quarantine legitimate emails\n- **Permissive policies**: `~all` (softfail) only marks emails as suspicious but does not reject them, `?all` (neutral) provides no protection",
+  "Risk": "Without **SPF** or with a permissive policy (`~all`, `?all`, `+all`), attackers can forge emails from your domain. Phishing attacks can harvest sensitive information from recipients who trust spoofed emails. Brand reputation is damaged by fraudulent emails. `~all` only marks emails as suspicious without rejecting them.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/dns/manage-dns-records/how-to/email-records/"

prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "Zone",
   "ResourceGroup": "network",
   "Description": "**Cloudflare zones** are assessed for **SSL/TLS encryption mode** by checking if the mode is set to `Full (Strict)` to ensure **end-to-end encryption** with certificate validation.",
-  "Risk": "Without **strict SSL mode**, traffic between Cloudflare and origin may use unvalidated or unencrypted connections.\n- **Confidentiality**: sensitive data can be intercepted in transit via man-in-the-middle attacks\n- **Integrity**: responses can be modified without detection between Cloudflare and origin\n- **Compliance**: may violate PCI-DSS, HIPAA, and other regulatory requirements for encrypted transport",
+  "Risk": "Without **strict SSL mode**, traffic between Cloudflare and origin may use unvalidated or unencrypted connections. Sensitive data can be intercepted via **man-in-the-middle attacks**, responses can be modified without detection, and this may violate PCI-DSS, HIPAA, and other regulatory requirements.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/"

prowler/providers/gcp/services/compute/compute_image_not_publicly_shared/compute_image_not_publicly_shared.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "medium",
   "ResourceType": "compute.googleapis.com/Image",
   "ResourceGroup": "compute",
-  "Description": "Custom disk images should not be shared publicly with **allAuthenticatedUsers**.\n\nNote: Per Google Cloud API restrictions, **allUsers** cannot be assigned to Compute Engine images. The security concern is **allAuthenticatedUsers**, which grants access to anyone with a Google account.\n\nPublicly shared disk images can expose application snapshots and sensitive data to anyone with a Google Cloud account, potentially leading to unauthorized access and data breaches.",
+  "Description": "Custom disk images should not be shared publicly with **allAuthenticatedUsers**. Per Google Cloud API restrictions, **allUsers** cannot be assigned to Compute Engine images. The concern is **allAuthenticatedUsers**, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.",
   "Risk": "Publicly shared disk images can expose **sensitive data** and application configurations to unauthorized users.\n\n- Any authenticated GCP user can access the image content\n- Could lead to **data breaches** if images contain secrets or proprietary code\n- Attackers may use exposed images to understand application architecture",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/gcp/services/compute/compute_instance_group_autohealing_enabled/compute_instance_group_autohealing_enabled.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "compute.googleapis.com/InstanceGroupManager",
   "ResourceGroup": "compute",
   "Description": "Managed Instance Groups (MIGs) should have **autohealing** enabled with a valid health check configured. Autohealing automatically recreates unhealthy instances based on application-level health checks, ensuring continuous availability.",
-  "Risk": "Without autohealing, MIGs cannot detect application-level failures such as crashes, freezes, or memory issues. Instances that are technically running but experiencing problems will remain undetected and unreplaced, leading to:\n\n- **Service degradation** from unhealthy instances\n- **Extended downtime** during application failures\n- **Manual intervention** required to detect and replace failed instances",
+  "Risk": "Without autohealing, MIGs cannot detect application-level failures such as crashes, freezes, or memory issues. Instances experiencing problems remain undetected and unreplaced, leading to **service degradation**, **extended downtime**, and requiring **manual intervention** to detect and replace failed instances.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs"

prowler/providers/gcp/services/compute/compute_instance_group_multiple_zones/compute_instance_group_multiple_zones.metadata.json

@@ -1,7 +1,7 @@
 {
   "Provider": "gcp",
   "CheckID": "compute_instance_group_multiple_zones",
-  "CheckTitle": "Ensure Managed Instance Groups span multiple zones for high availability",
+  "CheckTitle": "Managed Instance Groups span multiple zones for high availability",
   "CheckType": [],
   "ServiceName": "compute",
   "SubServiceName": "",

prowler/providers/gcp/services/compute/compute_instance_suspended_without_persistent_disks/compute_instance_suspended_without_persistent_disks.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "compute.googleapis.com/Instance",
   "ResourceGroup": "compute",
   "Description": "This check identifies VM instances in a **SUSPENDED** or **SUSPENDING** state with persistent disks still attached.\n\nPersistent disks on suspended VMs remain accessible through the GCP API and could contain **sensitive data** while the instance is inactive, potentially creating security blind spots in long-forgotten infrastructure.",
-  "Risk": "Persistent disks on suspended VM instances remain accessible through the GCP API and may contain **sensitive data**, creating potential security risks:\n\n- **Unauthorized data access** if credentials are compromised or permissions are misconfigured\n- **Data exposure** from forgotten infrastructure that is no longer actively monitored\n- **Security blind spots** where suspended resources are overlooked during security reviews and audits",
+  "Risk": "Persistent disks on suspended VM instances remain accessible through the GCP API and may contain **sensitive data**. This creates risks of **unauthorized data access** if permissions are misconfigured, **data exposure** from forgotten unmonitored infrastructure, and **security blind spots** where suspended resources are overlooked during reviews.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://cloud.google.com/icompute/docs/instances/suspend-resume-instance"

prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "MetricFilter",
   "ResourceGroup": "monitoring",
   "Description": "Log metric filters and alerts for **Compute Engine configuration changes** provide visibility into modifications to instances, disks, networks, firewalls, and routes. These monitoring controls enable security teams to detect unauthorized changes and investigate suspicious infrastructure modifications.",
-  "Risk": "Without monitoring for Compute Engine configuration changes, **unauthorized modifications** to compute resources may go undetected. Attackers can establish **persistence** through instance modifications, escalate privileges via IAM policy changes, disable security controls, or pivot to other resources. This compromises **confidentiality**, **integrity**, and **availability** of workloads and may enable **data exfiltration** or **lateral movement**.",
+  "Risk": "Without monitoring for Compute Engine configuration changes, **unauthorized modifications** may go undetected. Attackers can establish **persistence**, escalate privileges, disable security controls, or pivot to other resources, compromising **confidentiality**, **integrity**, and **availability** of workloads.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/ComputeEngine/gcp-compute-engine-configuration-changes.html",

prowler/providers/m365/services/defender/defender_zap_for_teams_enabled/defender_zap_for_teams_enabled.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "NotDefined",
   "ResourceGroup": "collaboration",
   "Description": "**Microsoft Defender for Office 365 Zero-hour auto purge (ZAP)** is a protection feature that retroactively detects and neutralizes **malware** and **high confidence phishing** in Teams messages.\n\nWhen ZAP blocks a message, it is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP can occur up to 48 hours after delivery.",
-  "Risk": "Without ZAP enabled, malicious content delivered to Teams chats remains accessible to users for up to 48 hours after delivery, even after being identified as harmful.\n\nThis extended exposure window could lead to:\n- **Malware infections** from weaponized attachments or links\n- **Phishing attacks** compromising user credentials and MFA tokens\n- **Lateral movement** as attackers exploit compromised accounts within the organization",
+  "Risk": "Without ZAP enabled, malicious content in Teams chats remains accessible for up to 48 hours after delivery, even after being identified as harmful. This extended exposure enables **malware infections**, **phishing attacks** compromising credentials and MFA tokens, and **lateral movement** via compromised accounts.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://learn.microsoft.com/en-us/defender-office-365/zero-hour-auto-purge?view=o365-worldwide#zero-hour-auto-purge-zap-in-microsoft-teams",

prowler/providers/openstack/services/image/image_signature_verification_enabled/image_signature_verification_enabled.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "high",
   "ResourceType": "OS::Glance::WebImage",
   "ResourceGroup": "storage",
-  "Description": "**OpenStack images** are evaluated to verify that all **four signature properties** are configured: `img_signature`, `img_signature_hash_method`, `img_signature_key_type`, and `img_signature_certificate_uuid`. Signed images allow Nova to verify image integrity before booting, detecting tampering or corruption. Best practices recommend signing all production images using Barbican-managed certificates.",
+  "Description": "**OpenStack images** are evaluated to verify that all **four signature properties** are configured: `img_signature`, `img_signature_hash_method`, `img_signature_key_type`, and `img_signature_certificate_uuid`. Signed images allow Nova to verify integrity before booting, detecting tampering or corruption.",
   "Risk": "Unsigned images can be tampered with to inject backdoors, malware, or rootkits without detection. Without signature verification, compromised storage backends or man-in-the-middle attacks can modify images between upload and boot. Nova cannot verify the integrity of unsigned images, allowing corrupted or malicious images to be launched.",
   "RelatedUrl": "",
   "AdditionalURLs": [

prowler/providers/openstack/services/networking/networking_security_group_allows_all_ingress_from_internet/networking_security_group_allows_all_ingress_from_internet.metadata.json

@@ -10,7 +10,7 @@
   "ResourceType": "OS::Neutron::SecurityGroup",
   "ResourceGroup": "network",
   "Description": "**OpenStack security groups** are evaluated to verify that no rule allows **all ingress traffic** (any protocol, any port) from the Internet (0.0.0.0/0 or ::/0). A rule with no protocol and no port restriction is effectively a \"permit any\" firewall rule, completely bypassing network-level access controls. This is the most permissive possible configuration and should never be used in production.",
-  "Risk": "Allowing all inbound traffic from the Internet exposes every service running on the instance to unauthorized access. Attackers can discover and exploit any listening service including databases, management interfaces, internal APIs, and debugging tools. This bypasses defense-in-depth and is equivalent to having no firewall. Combined with misconfigurations or unpatched services, it enables initial access, lateral movement, data exfiltration, and full infrastructure compromise.",
+  "Risk": "Allowing all inbound traffic from the Internet exposes every service on the instance to unauthorized access. Attackers can exploit any listening service including databases, management interfaces, and internal APIs. This bypasses defense-in-depth and enables initial access, lateral movement, data exfiltration, and infrastructure compromise.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.openstack.org/neutron/latest/admin/intro-os-networking.html",

prowler/providers/oraclecloud/services/events/events_rule_network_security_group_changes/events_rule_network_security_group_changes.metadata.json

@@ -9,7 +9,7 @@
   "Severity": "medium",
   "ResourceType": "EventRule",
   "ResourceGroup": "messaging",
-  "Description": "**OCI Events rules** targeting **Network Security Group (NSG)** changes are evaluated for the presence of **notification actions**. Monitored event types: `com.oraclecloud.virtualnetwork.createnetworksecuritygroup`, `com.oraclecloud.virtualnetwork.updatenetworksecuritygroup`, `com.oraclecloud.virtualnetwork.deletenetworksecuritygroup`, `com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment`.",
+  "Description": "**OCI Events rules** targeting **Network Security Group (NSG)** changes are evaluated for **notification actions**. Monitored events: `createnetworksecuritygroup`, `updatenetworksecuritygroup`, `deletenetworksecuritygroup`, and `changenetworksecuritygroupcompartment` under `com.oraclecloud.virtualnetwork`.",
   "Risk": "Absent notifications for NSG changes enable silent policy drift.\n- **Confidentiality**: permissive edits can expose services and drive data exfiltration.\n- **Integrity**: attackers can reroute traffic or bypass micro-segmentation.\n- **Availability**: deletions/misconfigurations may isolate workloads or widen DDoS exposure.",
   "RelatedUrl": "",
   "AdditionalURLs": [

tests/lib/check/check_loader_test.py

@@ -31,7 +31,9 @@ class TestCheckLoader:
             Provider="aws",
             CheckID=S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME,
             CheckTitle="Check S3 Bucket Level Public Access Block.",
-            CheckType=["Data Protection"],
+            CheckType=[
+                "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+            ],
             CheckAliases=[S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_CUSTOM_ALIAS],
             ServiceName=S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_SERVICE,
             SubServiceName="",
@@ -40,7 +42,7 @@ class TestCheckLoader:
             ResourceType="AwsS3Bucket",
             Description="Check S3 Bucket Level Public Access Block.",
             Risk="Public access policies may be applied to sensitive data buckets.",
-            RelatedUrl="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
+            RelatedUrl="",
             Remediation=Remediation(
                 Code=Code(
                     NativeIaC="",
@@ -50,7 +52,7 @@ class TestCheckLoader:
                 ),
                 Recommendation=Recommendation(
                     Text="You can enable Public Access Block at the bucket level to prevent the exposure of your data stored in S3.",
-                    Url="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
+                    Url="https://hub.prowler.com/check/s3_bucket_level_public_access_block",
                 ),
             ),
             Categories=["internet-exposed"],
@@ -65,7 +67,9 @@ class TestCheckLoader:
             Provider="aws",
             CheckID=IAM_USER_NO_MFA_NAME,
             CheckTitle="Check IAM User No MFA.",
-            CheckType=["Data Protection"],
+            CheckType=[
+                "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
+            ],
             CheckAliases=[IAM_USER_NO_MFA_NAME_CUSTOM_ALIAS],
             ServiceName=IAM_USER_NO_MFA_NAME_SERVICE,
             SubServiceName="",
@@ -74,7 +78,7 @@ class TestCheckLoader:
             ResourceType="AwsIamUser",
             Description="Check IAM User No MFA.",
             Risk="IAM users should have Multi-Factor Authentication (MFA) enabled.",
-            RelatedUrl="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html",
+            RelatedUrl="",
             Remediation=Remediation(
                 Code=Code(
                     NativeIaC="",
@@ -84,7 +88,7 @@ class TestCheckLoader:
                 ),
                 Recommendation=Recommendation(
                     Text="You can enable MFA for your IAM user to prevent unauthorized access to your AWS account.",
-                    Url="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html",
+                    Url="https://hub.prowler.com/check/iam_user_no_mfa",
                 ),
             ),
             Categories=[],
@@ -98,8 +102,8 @@ class TestCheckLoader:
         return CheckMetadata(
             Provider="aws",
             CheckID=CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME,
-            CheckTitle="Ensure there are no potential enumeration threats in CloudTrail",
-            CheckType=[],
+            CheckTitle="CloudTrail should not have potential enumeration threats",
+            CheckType=["TTPs/Discovery"],
             ServiceName="cloudtrail",
             SubServiceName="",
             ResourceIdTemplate="arn:partition:service:region:account-id:resource-id",
@@ -112,7 +116,7 @@ class TestCheckLoader:
                 Code=Code(CLI="", NativeIaC="", Other="", Terraform=""),
                 Recommendation=Recommendation(
                     Text="To remediate this issue, ensure that there are no potential enumeration threats in CloudTrail.",
-                    Url="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-logging-data-events",
+                    Url="https://hub.prowler.com/check/cloudtrail_threat_detection_enumeration",
                 ),
             ),
             Categories=["threat-detection"],
@@ -123,55 +127,55 @@ class TestCheckLoader:
         )
 
     def test_load_checks_to_execute(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             provider=self.provider,
         )
 
     def test_load_checks_to_execute_with_check_list(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         check_list = [S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME]
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             check_list=check_list,
             provider=self.provider,
         )
 
     def test_load_checks_to_execute_with_severities(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         severities = [S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_SEVERITY]
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             severities=severities,
             provider=self.provider,
         )
 
     def test_load_checks_to_execute_with_severities_and_services(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         service_list = [S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_SERVICE]
         severities = [S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_SEVERITY]
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             service_list=service_list,
             severities=severities,
             provider=self.provider,
         )
 
     def test_load_checks_to_execute_with_severities_and_services_multiple(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata(),
             IAM_USER_NO_MFA_NAME: self.get_custom_check_iam_metadata(),
         }
@@ -182,7 +186,7 @@ class TestCheckLoader:
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME,
             IAM_USER_NO_MFA_NAME,
         } == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             service_list=service_list,
             severities=severities,
             provider=self.provider,
@@ -211,7 +215,7 @@ class TestCheckLoader:
     def test_load_checks_to_execute_with_checks_file(
         self,
     ):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         checks_file = "path/to/test_file"
@@ -220,7 +224,7 @@ class TestCheckLoader:
             return_value={S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME},
         ):
             assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-                bulk_checks_metadata=bulk_checks_metatada,
+                bulk_checks_metadata=bulk_checks_metadata,
                 checks_file=checks_file,
                 provider=self.provider,
             )
@@ -228,13 +232,13 @@ class TestCheckLoader:
     def test_load_checks_to_execute_with_service_list(
         self,
     ):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         service_list = [S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME_SERVICE]
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             service_list=service_list,
             provider=self.provider,
         )
@@ -242,7 +246,7 @@ class TestCheckLoader:
     def test_load_checks_to_execute_with_compliance_frameworks(
         self,
     ):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         bulk_compliance_frameworks = {
@@ -264,34 +268,39 @@ class TestCheckLoader:
         }
         compliance_frameworks = ["soc2_aws"]
 
-        assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
-            bulk_compliance_frameworks=bulk_compliance_frameworks,
-            compliance_frameworks=compliance_frameworks,
-            provider=self.provider,
-        )
+        # Mock get_bulk to prevent loading real metadata files that may fail validation
+        with patch(
+            "prowler.lib.check.checks_loader.CheckMetadata.get_bulk",
+            return_value=bulk_checks_metadata,
+        ):
+            assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
+                bulk_checks_metadata=bulk_checks_metadata,
+                bulk_compliance_frameworks=bulk_compliance_frameworks,
+                compliance_frameworks=compliance_frameworks,
+                provider=self.provider,
+            )
 
     def test_load_checks_to_execute_with_categories(
         self,
     ):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         categories = {"internet-exposed"}
 
         assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             categories=categories,
             provider=self.provider,
         )
 
     def test_load_checks_to_execute_no_bulk_checks_metadata(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         with patch(
             "prowler.lib.check.checks_loader.CheckMetadata.get_bulk",
-            return_value=bulk_checks_metatada,
+            return_value=bulk_checks_metadata,
         ):
             assert {S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME} == load_checks_to_execute(
                 provider=self.provider,
@@ -318,13 +327,13 @@ class TestCheckLoader:
 
         compliance_frameworks = ["soc2_aws"]
 
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME: self.get_custom_check_s3_metadata()
         }
         with (
             patch(
                 "prowler.lib.check.checks_loader.CheckMetadata.get_bulk",
-                return_value=bulk_checks_metatada,
+                return_value=bulk_checks_metadata,
             ),
             patch(
                 "prowler.lib.check.checks_loader.Compliance.get_bulk",
@@ -351,38 +360,38 @@ class TestCheckLoader:
         )
 
     def test_threat_detection_category(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME: self.get_threat_detection_check_metadata()
         }
         categories = {"threat-detection"}
 
         assert {CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             categories=categories,
             provider=self.provider,
         )
 
     def test_discard_threat_detection_checks(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME: self.get_threat_detection_check_metadata()
         }
         categories = {}
 
         assert set() == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             categories=categories,
             provider=self.provider,
         )
 
     def test_threat_detection_single_check(self):
-        bulk_checks_metatada = {
+        bulk_checks_metadata = {
             CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME: self.get_threat_detection_check_metadata()
         }
         categories = {}
         check_list = [CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME]
 
         assert {CLOUDTRAIL_THREAT_DETECTION_ENUMERATION_NAME} == load_checks_to_execute(
-            bulk_checks_metadata=bulk_checks_metatada,
+            bulk_checks_metadata=bulk_checks_metadata,
             check_list=check_list,
             categories=categories,
             provider=self.provider,

tests/lib/check/check_test.py

@@ -24,7 +24,7 @@ from prowler.lib.check.check import (
     remove_custom_checks_module,
     update_audit_metadata,
 )
-from prowler.lib.check.models import load_check_metadata
+from prowler.lib.check.models import CheckMetadata, load_check_metadata
 from prowler.lib.check.utils import (
     list_modules,
     recover_checks_from_provider,
@@ -412,7 +412,7 @@ class TestCheck:
                 },
                 "expected": {
                     "CheckID": "iam_user_accesskey_unused",
-                    "CheckTitle": "Ensure Access Keys unused are disabled",
+                    "CheckTitle": "Access Keys unused should be disabled",
                     "ServiceName": "iam",
                     "Severity": "low",
                 },
@@ -502,7 +502,7 @@ class TestCheck:
             "ResourceType": "AwsCustomResource",
             "Description": "A test custom check",
             "Risk": "Test risk",
-            "RelatedUrl": "https://example.com",
+            "RelatedUrl": "",
             "Remediation": {
                 "Code": {"CLI": "", "NativeIaC": "", "Other": "", "Terraform": ""},
                 "Recommendation": {"Text": "", "Url": ""},
@@ -614,7 +614,7 @@ class TestCheck:
             "forensics-ready",
             "encryption",
             "internet-exposed",
-            "trustboundaries",
+            "trust-boundaries",
         }
         listed_categories = list_categories(test_bulk_checks_metadata)
         assert listed_categories == expected_categories
@@ -958,7 +958,98 @@ class TestCheck:
         )
         self.verify_metadata_check_id(base_directory)
 
+    def test_alibabacloud_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/alibabacloud/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_cloudflare_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/cloudflare/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_github_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/github/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_googleworkspace_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/googleworkspace/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_m365_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/m365/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_mongodbatlas_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/mongodbatlas/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_nhn_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/nhn/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_openstack_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/openstack/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
+    def test_oraclecloud_checks_metadata_is_valid(self):
+        base_directory = os.path.abspath(
+            os.path.join(
+                os.path.dirname(__file__),
+                "../../../",
+                "prowler/providers/oraclecloud/services",
+            )
+        )
+        self.verify_metadata_check_id(base_directory)
+
     def verify_metadata_check_id(self, provider_path):
+        errors = []
         # Walk through the base directory to find all service directories
         for root, dirs, _ in os.walk(provider_path):
             # We only want to look at directories that are direct children of the base directory
@@ -984,9 +1075,20 @@ class TestCheck:
                                 check_id = data.get("CheckID", None)
 
                                 # Compare CheckID to the check name
-                                assert (
-                                    check_id == check_dir
-                                ), f"CheckID in metadata does not match the check name in {check_directory}. Found CheckID: {check_id}"
+                                if check_id != check_dir:
+                                    errors.append(
+                                        f"CheckID in metadata does not match the check name in {check_directory}. Found CheckID: {check_id}"
+                                    )
+
+                                # Validate metadata against Pydantic validators
+                                try:
+                                    CheckMetadata.parse_file(metadata_file_path)
+                                except Exception as e:
+                                    errors.append(
+                                        f"Metadata validation failed for {metadata_file_path}: {e}"
+                                    )
+
+        assert not errors, "\n\n".join(errors)
 
     def test_execute_check_exception_only_logs(self, caplog):
         caplog.set_level(ERROR)

tests/lib/check/compliance_check_test.py

@@ -197,7 +197,7 @@ class TestCompliance:
                 Provider="aws",
                 CheckID="accessanalyzer_enabled",
                 CheckTitle="Check 1",
-                CheckType=["type1"],
+                CheckType=["TTPs/Initial Access"],
                 ServiceName="accessanalyzer",
                 SubServiceName="subservice1",
                 ResourceIdTemplate="template1",
@@ -205,7 +205,7 @@ class TestCompliance:
                 ResourceType="resource1",
                 Description="Description 1",
                 Risk="risk1",
-                RelatedUrl="url1",
+                RelatedUrl="",
                 Remediation={
                     "Code": {
                         "CLI": "cli1",
@@ -213,9 +213,12 @@ class TestCompliance:
                         "Other": "other1",
                         "Terraform": "terraform1",
                     },
-                    "Recommendation": {"Text": "text1", "Url": "url1"},
+                    "Recommendation": {
+                        "Text": "text1",
+                        "Url": "https://hub.prowler.com/check/accessanalyzer_enabled",
+                    },
                 },
-                Categories=["categoryone"],
+                Categories=["encryption"],
                 DependsOn=["dependency1"],
                 RelatedTo=["related1"],
                 Notes="notes1",
@@ -225,7 +228,7 @@ class TestCompliance:
                 Provider="aws",
                 CheckID="iam_user_mfa_enabled_console_access",
                 CheckTitle="Check 2",
-                CheckType=["type2"],
+                CheckType=["TTPs/Credential Access"],
                 ServiceName="iam",
                 SubServiceName="subservice2",
                 ResourceIdTemplate="template2",
@@ -233,7 +236,7 @@ class TestCompliance:
                 ResourceType="resource2",
                 Description="Description 2",
                 Risk="risk2",
-                RelatedUrl="url2",
+                RelatedUrl="",
                 Remediation={
                     "Code": {
                         "CLI": "cli2",
@@ -241,9 +244,12 @@ class TestCompliance:
                         "Other": "other2",
                         "Terraform": "terraform2",
                     },
-                    "Recommendation": {"Text": "text2", "Url": "url2"},
+                    "Recommendation": {
+                        "Text": "text2",
+                        "Url": "https://hub.prowler.com/check/iam_user_mfa_enabled_console_access",
+                    },
                 },
-                Categories=["categorytwo"],
+                Categories=["logging"],
                 DependsOn=["dependency2"],
                 RelatedTo=["related2"],
                 Notes="notes2",

tests/lib/check/custom_checks_metadata_test.py

@@ -27,7 +27,9 @@ S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_REMEDIATION_OTHER = "https://github.com/clou
 S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_REMEDIATION_TEXT = (
     "Enable the S3 bucket level public access block."
 )
-S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_REMEDIATION_URL = "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
+S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_REMEDIATION_URL = (
+    "https://hub.prowler.com/check/s3_bucket_level_public_access_block"
+)
 
 
 class TestCustomChecksMetadata:
@@ -36,7 +38,7 @@ class TestCustomChecksMetadata:
             Provider="aws",
             CheckID=S3_BUCKET_LEVEL_PUBLIC_ACCESS_BLOCK_NAME,
             CheckTitle="Check S3 Bucket Level Public Access Block.",
-            CheckType=["Data Protection"],
+            CheckType=["Sensitive Data Identifications/PII"],
             CheckAliases=[],
             ServiceName="s3",
             SubServiceName="",
@@ -45,7 +47,7 @@ class TestCustomChecksMetadata:
             ResourceType="AwsS3Bucket",
             Description="Check S3 Bucket Level Public Access Block.",
             Risk="Public access policies may be applied to sensitive data buckets.",
-            RelatedUrl="https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
+            RelatedUrl="",
             Remediation=Remediation(
                 Code=Code(
                     NativeIaC="",

tests/lib/check/fixtures/bulk_checks_metadata.py

@@ -4,14 +4,16 @@ test_bulk_checks_metadata = {
     "vpc_peering_routing_tables_with_least_privilege": CheckMetadata(
         Provider="aws",
         CheckID="vpc_peering_routing_tables_with_least_privilege",
-        CheckTitle="Ensure routing tables for VPC peering are least access.",
-        CheckType=["Infrastructure Security"],
+        CheckTitle="VPC peering routing tables should follow least access.",
+        CheckType=[
+            "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+        ],
         ServiceName="vpc",
         SubServiceName="route_table",
         ResourceIdTemplate="arn:partition:service:region:account-id:resource-id",
         Severity="medium",
         ResourceType="AwsEc2VpcPeeringConnection",
-        Description="Ensure routing tables for VPC peering are least access.",
+        Description="VPC peering routing tables should follow least access.",
         Risk="Being highly selective in peering routing tables is a very effective way of minimizing the impact of breach as resources outside of these routes are inaccessible to the peered VPC.",
         RelatedUrl="",
         Remediation=Remediation(
@@ -23,7 +25,7 @@ test_bulk_checks_metadata = {
             ),
             Recommendation=Recommendation(
                 Text="Review routing tables of peered VPCs for whether they route all subnets of each VPC and whether that is necessary to accomplish the intended purposes for peering the VPCs.",
-                Url="https://docs.aws.amazon.com/vpc/latest/peering/peering-configurations-partial-access.html",
+                Url="https://hub.prowler.com/check/vpc_peering_routing_tables_with_least_privilege",
             ),
         ),
         Categories=["forensics-ready"],
@@ -35,8 +37,10 @@ test_bulk_checks_metadata = {
     "vpc_subnet_different_az": CheckMetadata(
         Provider="aws",
         CheckID="vpc_subnet_different_az",
-        CheckTitle="Ensure all vpc has subnets in more than one availability zone",
-        CheckType=["Infrastructure Security"],
+        CheckTitle="VPC should have subnets in more than one availability zone",
+        CheckType=[
+            "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+        ],
         ServiceName="vpc",
         SubServiceName="subnet",
         ResourceIdTemplate="arn:partition:service:region:account-id:resource-id",
@@ -44,13 +48,13 @@ test_bulk_checks_metadata = {
         ResourceType="AwsEc2Vpc",
         Description="Ensure all vpc has subnets in more than one availability zone",
         Risk="",
-        RelatedUrl="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html",
+        RelatedUrl="",
         Remediation=Remediation(
             Code=Code(
                 NativeIaC="", Terraform="", CLI="aws ec2 create-subnet", Other=""
             ),
             Recommendation=Recommendation(
-                Text="Ensure all vpc has subnets in more than one availability zone",
+                Text="VPC should have subnets in more than one availability zone",
                 Url="",
             ),
         ),
@@ -63,8 +67,10 @@ test_bulk_checks_metadata = {
     "vpc_subnet_separate_private_public": CheckMetadata(
         Provider="aws",
         CheckID="vpc_subnet_separate_private_public",
-        CheckTitle="Ensure all vpc has public and private subnets defined",
-        CheckType=["Infrastructure Security"],
+        CheckTitle="VPC should have public and private subnets defined",
+        CheckType=[
+            "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+        ],
         ServiceName="vpc",
         SubServiceName="subnet",
         ResourceIdTemplate="arn:partition:service:region:account-id:resource-id",
@@ -72,16 +78,16 @@ test_bulk_checks_metadata = {
         ResourceType="AwsEc2Vpc",
         Description="Ensure all vpc has public and private subnets defined",
         Risk="",
-        RelatedUrl="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html",
+        RelatedUrl="",
         Remediation=Remediation(
             Code=Code(
                 NativeIaC="", Terraform="", CLI="aws ec2 create-subnet", Other=""
             ),
             Recommendation=Recommendation(
-                Text="Ensure all vpc has public and private subnets defined", Url=""
+                Text="VPC should have public and private subnets defined", Url=""
             ),
         ),
-        Categories=["internet-exposed", "trustboundaries"],
+        Categories=["internet-exposed", "trust-boundaries"],
         DependsOn=[],
         RelatedTo=[],
         Notes="",
@@ -90,16 +96,18 @@ test_bulk_checks_metadata = {
     "workspaces_volume_encryption_enabled": CheckMetadata(
         Provider="aws",
         CheckID="workspaces_volume_encryption_enabled",
-        CheckTitle="Ensure that your Amazon WorkSpaces storage volumes are encrypted in order to meet security and compliance requirements",
-        CheckType=[],
+        CheckTitle="Amazon WorkSpaces storage volumes should be encrypted",
+        CheckType=[
+            "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis"
+        ],
         ServiceName="workspaces",
         SubServiceName="",
         ResourceIdTemplate="arn:aws:workspaces:region:account-id:workspace",
         Severity="high",
         ResourceType="AwsWorkspaces",
-        Description="Ensure that your Amazon WorkSpaces storage volumes are encrypted in order to meet security and compliance requirements",
+        Description="Amazon WorkSpaces storage volumes should be encrypted to meet security and compliance requirements",
         Risk="If the value listed in the Volume Encryption column is Disabled the selected AWS WorkSpaces instance volumes (root and user volumes) are not encrypted. Therefore your data-at-rest is not protected from unauthorized access and does not meet the compliance requirements regarding data encryption.",
-        RelatedUrl="https://docs.aws.amazon.com/workspaces/latest/adminguide/encrypt-workspaces.html",
+        RelatedUrl="",
         Remediation=Remediation(
             Code=Code(
                 NativeIaC="https://docs.prowler.com/checks/ensure-that-workspace-root-volumes-are-encrypted#cloudformation",
@@ -109,7 +117,7 @@ test_bulk_checks_metadata = {
             ),
             Recommendation=Recommendation(
                 Text="WorkSpaces is integrated with the AWS Key Management Service (AWS KMS). This enables you to encrypt storage volumes of WorkSpaces using AWS KMS Key. When you launch a WorkSpace you can encrypt the root volume (for Microsoft Windows - the C drive; for Linux - /) and the user volume (for Windows - the D drive; for Linux - /home). Doing so ensures that the data stored at rest - disk I/O to the volume - and snapshots created from the volumes are all encrypted",
-                Url="https://docs.aws.amazon.com/workspaces/latest/adminguide/encrypt-workspaces.html",
+                Url="https://hub.prowler.com/check/workspaces_volume_encryption_enabled",
             ),
         ),
         Categories=["encryption"],
@@ -121,21 +129,23 @@ test_bulk_checks_metadata = {
     "workspaces_vpc_2private_1public_subnets_nat": CheckMetadata(
         Provider="aws",
         CheckID="workspaces_vpc_2private_1public_subnets_nat",
-        CheckTitle="Ensure that the Workspaces VPC are deployed following the best practices using 1 public subnet and 2 private subnets with a NAT Gateway attached",
-        CheckType=[],
+        CheckTitle="Workspaces VPC should use 1 public and 2 private subnets with NAT Gateway",
+        CheckType=[
+            "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis"
+        ],
         ServiceName="workspaces",
         SubServiceName="",
         ResourceIdTemplate="arn:aws:workspaces:region:account-id:workspace",
         Severity="medium",
         ResourceType="AwsWorkspaces",
-        Description="Ensure that the Workspaces VPC are deployed following the best practices using 1 public subnet and 2 private subnets with a NAT Gateway attached",
+        Description="Workspaces VPC should be deployed with 1 public subnet and 2 private subnets with a NAT Gateway attached",
         Risk="Proper network segmentation is a key security best practice. Workspaces VPC should be deployed using 1 public subnet and 2 private subnets with a NAT Gateway attached",
-        RelatedUrl="https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-vpc.html",
+        RelatedUrl="",
         Remediation=Remediation(
             Code=Code(NativeIaC="", Terraform="", CLI="", Other=""),
             Recommendation=Recommendation(
                 Text="Follow the documentation and deploy Workspaces VPC using 1 public subnet and 2 private subnets with a NAT Gateway attached",
-                Url="https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces-vpc.html",
+                Url="https://hub.prowler.com/check/workspaces_vpc_2private_1public_subnets_nat",
             ),
         ),
         Categories=[],

tests/lib/check/fixtures/metadata.json

@@ -1,10 +1,10 @@
 {
   "Categories": [
-    "cat-one",
-    "cat-two"
+    "encryption",
+    "logging"
   ],
   "CheckID": "iam_user_accesskey_unused",
-  "CheckTitle": "Ensure Access Keys unused are disabled",
+  "CheckTitle": "Access Keys unused should be disabled",
   "CheckType": [
     "Software and Configuration Checks"
   ],
@@ -25,14 +25,14 @@
     "othercheck1",
     "othercheck2"
   ],
-  "Description": "Ensure Access Keys unused are disabled",
+  "Description": "Access Keys unused should be disabled",
   "Notes": "additional information",
   "Provider": "aws",
   "RelatedTo": [
     "othercheck3",
     "othercheck4"
   ],
-  "RelatedUrl": "https://serviceofficialsiteorpageforthissubject",
+  "RelatedUrl": "",
   "Remediation": {
     "Code": {
       "CLI": "cli command or URL to the cli command location.",
@@ -42,7 +42,7 @@
     },
     "Recommendation": {
       "Text": "Run sudo yum update and cross your fingers and toes.",
-      "Url": "https://myfp.com/recommendations/dangerous_things_and_how_to_fix_them.html"
+      "Url": "https://hub.prowler.com/check/iam_user_accesskey_unused"
     }
   },
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",

tests/lib/outputs/asff/asff_test.py

@@ -554,7 +554,9 @@ class TestASFF:
                 },
                 "GeneratorId": "prowler-service_test_check_id",
                 "AwsAccountId": "123456789012",
-                "Types": ["test-type"],
+                "Types": [
+                    "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+                ],
                 "FirstObservedAt": timestamp,
                 "UpdatedAt": timestamp,
                 "CreatedAt": timestamp,

tests/lib/outputs/csv/csv_test.py

@@ -29,15 +29,15 @@ class TestCSV:
                 partition="aws",
                 description="Description of the finding",
                 risk="High",
-                related_url="http://example.com",
+                related_url="",
                 remediation_recommendation_text="Recommendation text",
-                remediation_recommendation_url="http://example.com/remediation",
+                remediation_recommendation_url="https://hub.prowler.com/check/test_check",
                 remediation_code_nativeiac="native-iac-code",
                 remediation_code_terraform="terraform-code",
                 remediation_code_other="other-code",
                 remediation_code_cli="cli-code",
                 compliance={"compliance_key": "compliance_value"},
-                categories=["categorya", "categoryb"],
+                categories=["encryption", "logging"],
                 depends_on=["dependency"],
                 related_to=["related"],
                 additional_urls=[
@@ -65,7 +65,10 @@ class TestCSV:
         assert output_data["PROVIDER"] == "aws"
         assert output_data["CHECK_ID"] == "service_test_check_id"
         assert output_data["CHECK_TITLE"] == "service_test_check_id"
-        assert output_data["CHECK_TYPE"] == "test-type"
+        assert (
+            output_data["CHECK_TYPE"]
+            == "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+        )
         assert isinstance(output_data["STATUS"], str)
         assert output_data["STATUS"] == "PASS"
         assert output_data["STATUS_EXTENDED"] == "status-extended"
@@ -86,11 +89,11 @@ class TestCSV:
         assert output_data["REGION"] == AWS_REGION_EU_WEST_1
         assert output_data["DESCRIPTION"] == "Description of the finding"
         assert output_data["RISK"] == "High"
-        assert output_data["RELATED_URL"] == "http://example.com"
+        assert output_data["RELATED_URL"] == ""
         assert output_data["REMEDIATION_RECOMMENDATION_TEXT"] == "Recommendation text"
         assert (
             output_data["REMEDIATION_RECOMMENDATION_URL"]
-            == "http://example.com/remediation"
+            == "https://hub.prowler.com/check/test_check"
         )
         assert output_data["REMEDIATION_CODE_NATIVEIAC"] == "native-iac-code"
         assert output_data["REMEDIATION_CODE_TERRAFORM"] == "terraform-code"
@@ -98,7 +101,7 @@ class TestCSV:
         assert output_data["REMEDIATION_CODE_OTHER"] == "other-code"
         assert isinstance(output_data["COMPLIANCE"], str)
         assert output_data["COMPLIANCE"] == "compliance_key: compliance_value"
-        assert output_data["CATEGORIES"] == "categorya | categoryb"
+        assert output_data["CATEGORIES"] == "encryption | logging"
         assert output_data["DEPENDS_ON"] == "dependency"
         assert output_data["RELATED_TO"] == "related"
         assert (
@@ -123,7 +126,7 @@ class TestCSV:
             output.batch_write_data_to_file()
 
         mock_file.seek(0)
-        expected_csv = f"AUTH_METHOD;TIMESTAMP;ACCOUNT_UID;ACCOUNT_NAME;ACCOUNT_EMAIL;ACCOUNT_ORGANIZATION_UID;ACCOUNT_ORGANIZATION_NAME;ACCOUNT_TAGS;FINDING_UID;PROVIDER;CHECK_ID;CHECK_TITLE;CHECK_TYPE;STATUS;STATUS_EXTENDED;MUTED;SERVICE_NAME;SUBSERVICE_NAME;SEVERITY;RESOURCE_TYPE;RESOURCE_UID;RESOURCE_NAME;RESOURCE_DETAILS;RESOURCE_TAGS;PARTITION;REGION;DESCRIPTION;RISK;RELATED_URL;REMEDIATION_RECOMMENDATION_TEXT;REMEDIATION_RECOMMENDATION_URL;REMEDIATION_CODE_NATIVEIAC;REMEDIATION_CODE_TERRAFORM;REMEDIATION_CODE_CLI;REMEDIATION_CODE_OTHER;COMPLIANCE;CATEGORIES;DEPENDS_ON;RELATED_TO;NOTES;PROWLER_VERSION;ADDITIONAL_URLS;ACCOUNT_OU_UID;ACCOUNT_OU_NAME\r\nprofile: default;{datetime.now()};123456789012;123456789012;;test-organization-id;test-organization;test-tag:test-value;test-unique-finding;aws;service_test_check_id;service_test_check_id;test-type;PASS;;False;service;;high;test-resource;;;;;aws;eu-west-1;check description;test-risk;test-url;;;;;;;test-compliance: test-compliance;test-category;test-dependency;test-related-to;test-notes;{prowler_version};https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/best-practices.html | https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/introduction.html;ou-abc1-12345678;Production/WebServices\r\n"
+        expected_csv = f"AUTH_METHOD;TIMESTAMP;ACCOUNT_UID;ACCOUNT_NAME;ACCOUNT_EMAIL;ACCOUNT_ORGANIZATION_UID;ACCOUNT_ORGANIZATION_NAME;ACCOUNT_TAGS;FINDING_UID;PROVIDER;CHECK_ID;CHECK_TITLE;CHECK_TYPE;STATUS;STATUS_EXTENDED;MUTED;SERVICE_NAME;SUBSERVICE_NAME;SEVERITY;RESOURCE_TYPE;RESOURCE_UID;RESOURCE_NAME;RESOURCE_DETAILS;RESOURCE_TAGS;PARTITION;REGION;DESCRIPTION;RISK;RELATED_URL;REMEDIATION_RECOMMENDATION_TEXT;REMEDIATION_RECOMMENDATION_URL;REMEDIATION_CODE_NATIVEIAC;REMEDIATION_CODE_TERRAFORM;REMEDIATION_CODE_CLI;REMEDIATION_CODE_OTHER;COMPLIANCE;CATEGORIES;DEPENDS_ON;RELATED_TO;NOTES;PROWLER_VERSION;ADDITIONAL_URLS;ACCOUNT_OU_UID;ACCOUNT_OU_NAME\r\nprofile: default;{datetime.now()};123456789012;123456789012;;test-organization-id;test-organization;test-tag:test-value;test-unique-finding;aws;service_test_check_id;service_test_check_id;Software and Configuration Checks/AWS Security Best Practices/Network Reachability;PASS;;False;service;;high;test-resource;;;;;aws;eu-west-1;check description;test-risk;;;;;;;;test-compliance: test-compliance;encryption;test-dependency;test-related-to;test-notes;{prowler_version};https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/best-practices.html | https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/introduction.html;ou-abc1-12345678;Production/WebServices\r\n"
         content = mock_file.read()
 
         assert content == expected_csv
@@ -201,7 +204,7 @@ class TestCSV:
             with patch.object(temp_file, "close", return_value=None):
                 csv.batch_write_data_to_file()
 
-            expected_csv = f"AUTH_METHOD;TIMESTAMP;ACCOUNT_UID;ACCOUNT_NAME;ACCOUNT_EMAIL;ACCOUNT_ORGANIZATION_UID;ACCOUNT_ORGANIZATION_NAME;ACCOUNT_TAGS;FINDING_UID;PROVIDER;CHECK_ID;CHECK_TITLE;CHECK_TYPE;STATUS;STATUS_EXTENDED;MUTED;SERVICE_NAME;SUBSERVICE_NAME;SEVERITY;RESOURCE_TYPE;RESOURCE_UID;RESOURCE_NAME;RESOURCE_DETAILS;RESOURCE_TAGS;PARTITION;REGION;DESCRIPTION;RISK;RELATED_URL;REMEDIATION_RECOMMENDATION_TEXT;REMEDIATION_RECOMMENDATION_URL;REMEDIATION_CODE_NATIVEIAC;REMEDIATION_CODE_TERRAFORM;REMEDIATION_CODE_CLI;REMEDIATION_CODE_OTHER;COMPLIANCE;CATEGORIES;DEPENDS_ON;RELATED_TO;NOTES;PROWLER_VERSION;ADDITIONAL_URLS;ACCOUNT_OU_UID;ACCOUNT_OU_NAME\nprofile: default;{datetime.now()};123456789012;123456789012;;test-organization-id;test-organization;test-tag:test-value;test-unique-finding;aws;service_test_check_id;service_test_check_id;test-type;PASS;;False;service;;high;test-resource;;;;;aws;eu-west-1;check description;test-risk;test-url;;;;;;;test-compliance: test-compliance;test-category;test-dependency;test-related-to;test-notes;{prowler_version};https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/best-practices.html | https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/introduction.html;ou-abc1-12345678;Production/WebServices\n"
+            expected_csv = f"AUTH_METHOD;TIMESTAMP;ACCOUNT_UID;ACCOUNT_NAME;ACCOUNT_EMAIL;ACCOUNT_ORGANIZATION_UID;ACCOUNT_ORGANIZATION_NAME;ACCOUNT_TAGS;FINDING_UID;PROVIDER;CHECK_ID;CHECK_TITLE;CHECK_TYPE;STATUS;STATUS_EXTENDED;MUTED;SERVICE_NAME;SUBSERVICE_NAME;SEVERITY;RESOURCE_TYPE;RESOURCE_UID;RESOURCE_NAME;RESOURCE_DETAILS;RESOURCE_TAGS;PARTITION;REGION;DESCRIPTION;RISK;RELATED_URL;REMEDIATION_RECOMMENDATION_TEXT;REMEDIATION_RECOMMENDATION_URL;REMEDIATION_CODE_NATIVEIAC;REMEDIATION_CODE_TERRAFORM;REMEDIATION_CODE_CLI;REMEDIATION_CODE_OTHER;COMPLIANCE;CATEGORIES;DEPENDS_ON;RELATED_TO;NOTES;PROWLER_VERSION;ADDITIONAL_URLS;ACCOUNT_OU_UID;ACCOUNT_OU_NAME\nprofile: default;{datetime.now()};123456789012;123456789012;;test-organization-id;test-organization;test-tag:test-value;test-unique-finding;aws;service_test_check_id;service_test_check_id;Software and Configuration Checks/AWS Security Best Practices/Network Reachability;PASS;;False;service;;high;test-resource;;;;;aws;eu-west-1;check description;test-risk;;;;;;;;test-compliance: test-compliance;encryption;test-dependency;test-related-to;test-notes;{prowler_version};https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/best-practices.html | https://docs.aws.amazon.com/prescriptive-guidance/latest/migration-operations-integration/introduction.html;ou-abc1-12345678;Production/WebServices\n"
 
             temp_file.seek(0)
 

tests/lib/outputs/finding_test.py

@@ -910,16 +910,19 @@ class TestFinding:
             "provider": "test_provider",
             "checkid": "service_check_001",
             "checktitle": "Test Check",
-            "checktype": ["type1"],
+            "checktype": [],
             "servicename": "service",
             "subservicename": "SubService",
             "severity": "high",
             "resourcetype": "TestResource",
             "description": "A test check",
             "risk": "High risk",
-            "relatedurl": "http://example.com",
+            "relatedurl": "",
             "remediation": {
-                "recommendation": {"text": "Fix it", "url": "http://fix.com"},
+                "recommendation": {
+                    "text": "Fix it",
+                    "url": "https://hub.prowler.com/check/service_check_001",
+                },
                 "code": {
                     "nativeiac": "iac_code",
                     "terraform": "terraform_code",
@@ -928,7 +931,7 @@ class TestFinding:
                 },
             },
             "resourceidtemplate": "template",
-            "categories": ["cat-one", "cat-two"],
+            "categories": ["encryption", "logging"],
             "dependson": ["dep1"],
             "relatedto": ["rel1"],
             "notes": "Some notes",
@@ -953,22 +956,25 @@ class TestFinding:
         assert meta.Provider == "test_provider"
         assert meta.CheckID == "service_check_001"
         assert meta.CheckTitle == "Test Check"
-        assert meta.CheckType == ["type1"]
+        assert meta.CheckType == []
         assert meta.ServiceName == "service"
         assert meta.SubServiceName == "SubService"
         assert meta.Severity == "high"
         assert meta.ResourceType == "TestResource"
         assert meta.Description == "A test check"
         assert meta.Risk == "High risk"
-        assert meta.RelatedUrl == "http://example.com"
+        assert meta.RelatedUrl == ""
         assert meta.Remediation.Recommendation.Text == "Fix it"
-        assert meta.Remediation.Recommendation.Url == "http://fix.com"
+        assert (
+            meta.Remediation.Recommendation.Url
+            == "https://hub.prowler.com/check/service_check_001"
+        )
         assert meta.Remediation.Code.NativeIaC == "iac_code"
         assert meta.Remediation.Code.Terraform == "terraform_code"
         assert meta.Remediation.Code.CLI == "cli_code"
         assert meta.Remediation.Code.Other == "other_code"
         assert meta.ResourceIdTemplate == "template"
-        assert meta.Categories == ["cat-one", "cat-two"]
+        assert meta.Categories == ["encryption", "logging"]
         assert meta.DependsOn == ["dep1"]
         assert meta.RelatedTo == ["rel1"]
         assert meta.Notes == "Some notes"
@@ -1034,11 +1040,11 @@ class TestFinding:
             "dependson": [],
             "relatedto": [],
             "categories": [],
-            "checktitle": "Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'",
+            "checktitle": "Auto provisioning of Log Analytics agent for Azure VMs should be On",
             "compliance": None,
-            "relatedurl": "https://docs.microsoft.com/en-us/azure/security-center/security-center-data-security",
+            "relatedurl": "",
             "description": (
-                "Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'. "
+                "Auto provisioning of Log Analytics agent for Azure VMs should be On. "
                 "The Microsoft Monitoring Agent scans for various security-related configurations and events such as system updates, "
                 "OS vulnerabilities, endpoint protection, and provides alerts."
             ),
@@ -1050,9 +1056,9 @@ class TestFinding:
                     "terraform": "",
                 },
                 "recommendation": {
-                    "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components",
+                    "url": "https://hub.prowler.com/check/defender_auto_provisioning_log_analytics_agent_vms_on",
                     "text": (
-                        "Ensure comprehensive visibility into possible security vulnerabilities, including missing updates, "
+                        "Comprehensive visibility into possible security vulnerabilities, including missing updates, "
                         "misconfigured operating system security settings, and active threats, allowing for timely mitigation and improved overall security posture"
                     ),
                 },
@@ -1099,16 +1105,16 @@ class TestFinding:
         assert meta.CheckID == "defender_auto_provisioning_log_analytics_agent_vms_on"
         assert (
             meta.CheckTitle
-            == "Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'"
+            == "Auto provisioning of Log Analytics agent for Azure VMs should be On"
         )
         assert meta.Severity == "medium"
         assert meta.ResourceType == "AzureDefenderPlan"
         assert (
             meta.Remediation.Recommendation.Url
-            == "https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components"
+            == "https://hub.prowler.com/check/defender_auto_provisioning_log_analytics_agent_vms_on"
         )
         assert meta.Remediation.Recommendation.Text.startswith(
-            "Ensure comprehensive visibility"
+            "Comprehensive visibility"
         )
 
         expected_segments = [
@@ -1156,7 +1162,7 @@ class TestFinding:
             "resourcetype": "GCPResourceType",
             "description": "GCP check description",
             "risk": "Medium risk",
-            "relatedurl": "http://gcp.example.com",
+            "relatedurl": "",
             "remediation": {
                 "code": {
                     "nativeiac": "iac_code",
@@ -1164,10 +1170,13 @@ class TestFinding:
                     "cli": "cli_code",
                     "other": "other_code",
                 },
-                "recommendation": {"text": "Fix it", "url": "http://fix-gcp.com"},
+                "recommendation": {
+                    "text": "Fix it",
+                    "url": "https://hub.prowler.com/check/service_gcp_check_001",
+                },
             },
             "resourceidtemplate": "template",
-            "categories": ["cat-one", "cat-two"],
+            "categories": ["encryption", "logging"],
             "dependson": ["dep1"],
             "relatedto": ["rel1"],
             "notes": "Some notes",
@@ -1236,7 +1245,7 @@ class TestFinding:
             "resourcetype": "K8sResourceType",
             "description": "K8s check description",
             "risk": "Low risk",
-            "relatedurl": "http://k8s.example.com",
+            "relatedurl": "",
             "remediation": {
                 "code": {
                     "nativeiac": "iac_code",
@@ -1244,10 +1253,13 @@ class TestFinding:
                     "cli": "cli_code",
                     "other": "other_code",
                 },
-                "recommendation": {"text": "Fix it", "url": "http://fix-k8s.com"},
+                "recommendation": {
+                    "text": "Fix it",
+                    "url": "https://hub.prowler.com/check/service_k8s_check_001",
+                },
             },
             "resourceidtemplate": "template",
-            "categories": ["cat-one"],
+            "categories": ["encryption"],
             "dependson": [],
             "relatedto": [],
             "notes": "K8s notes",
@@ -1302,7 +1314,7 @@ class TestFinding:
             "resourcetype": "M365ResourceType",
             "description": "M365 check description",
             "risk": "High risk",
-            "relatedurl": "http://m365.example.com",
+            "relatedurl": "",
             "remediation": {
                 "code": {
                     "nativeiac": "iac_code",
@@ -1310,10 +1322,13 @@ class TestFinding:
                     "cli": "cli_code",
                     "other": "other_code",
                 },
-                "recommendation": {"text": "Fix it", "url": "http://fix-m365.com"},
+                "recommendation": {
+                    "text": "Fix it",
+                    "url": "https://hub.prowler.com/check/service_m365_check_001",
+                },
             },
             "resourceidtemplate": "template",
-            "categories": ["cat-one"],
+            "categories": ["encryption"],
             "dependson": [],
             "relatedto": [],
             "notes": "M365 notes",

tests/lib/outputs/fixtures/fixtures.py

@@ -25,14 +25,14 @@ def generate_finding_output(
     partition: str = "aws",
     description: str = "check description",
     risk: str = "test-risk",
-    related_url: str = "test-url",
+    related_url: str = "",
     remediation_recommendation_text: str = "",
     remediation_recommendation_url: str = "",
     remediation_code_nativeiac: str = "",
     remediation_code_terraform: str = "",
     remediation_code_cli: str = "",
     remediation_code_other: str = "",
-    categories: list[str] = ["test-category"],
+    categories: list[str] = ["encryption"],
     depends_on: list[str] = ["test-dependency"],
     related_to: list[str] = ["test-related-to"],
     notes: str = "test-notes",
@@ -43,11 +43,19 @@ def generate_finding_output(
     service_name: str = "service",
     check_id: str = "service_test_check_id",
     check_title: str = "service_test_check_id",
-    check_type: list[str] = ["test-type"],
+    check_type: list[str] = None,
     provider_uid: str = None,
     account_ou_uid: str = "ou-abc1-12345678",
     account_ou_name: str = "Production/WebServices",
 ) -> Finding:
+    if check_type is None:
+        check_type = (
+            [
+                "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+            ]
+            if provider == "aws"
+            else []
+        )
     return Finding(
         auth_method="profile: default",
         timestamp=timestamp if timestamp else datetime.now(),

tests/lib/outputs/fixtures/metadata.json

@@ -1,10 +1,10 @@
 {
   "Categories": [
-    "cat-one",
-    "cat-two"
+    "encryption",
+    "logging"
   ],
   "CheckID": "iam_user_accesskey_unused",
-  "CheckTitle": "Ensure Access Keys unused are disabled",
+  "CheckTitle": "Access Keys unused should be disabled",
   "CheckType": [
     "Software and Configuration Checks"
   ],
@@ -25,14 +25,14 @@
     "othercheck1",
     "othercheck2"
   ],
-  "Description": "Ensure Access Keys unused are disabled",
+  "Description": "Access Keys unused should be disabled",
   "Notes": "additional information",
   "Provider": "aws",
   "RelatedTo": [
     "othercheck3",
     "othercheck4"
   ],
-  "RelatedUrl": "https://serviceofficialsiteorpageforthissubject",
+  "RelatedUrl": "",
   "Remediation": {
     "Code": {
       "CLI": "cli command or URL to the cli command location.",
@@ -42,7 +42,7 @@
     },
     "Recommendation": {
       "Text": "Run sudo yum update and cross your fingers and toes.",
-      "Url": "https://myfp.com/recommendations/dangerous_things_and_how_to_fix_them.html"
+      "Url": "https://hub.prowler.com/check/iam_user_accesskey_unused"
     }
   },
   "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",

tests/lib/outputs/ocsf/ocsf_test.py

@@ -65,7 +65,9 @@ class TestOCSF:
         assert output_data.finding_info.desc == findings[0].metadata.Description
         assert output_data.finding_info.title == findings[0].metadata.CheckTitle
         assert output_data.finding_info.uid == findings[0].uid
-        assert output_data.finding_info.types == ["test-type"]
+        assert output_data.finding_info.types == [
+            "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+        ]
         assert output_data.time == int(findings[0].timestamp.timestamp())
         assert output_data.time_dt == findings[0].timestamp
         assert (
@@ -211,8 +213,8 @@ class TestOCSF:
                 "status_detail": "status extended",
                 "status_id": 1,
                 "unmapped": {
-                    "related_url": "test-url",
-                    "categories": ["test-category"],
+                    "related_url": "",
+                    "categories": ["encryption"],
                     "depends_on": ["test-dependency"],
                     "related_to": ["test-related-to"],
                     "additional_urls": [
@@ -232,7 +234,9 @@ class TestOCSF:
                     "desc": "check description",
                     "title": "service_test_check_id",
                     "uid": "test-unique-finding",
-                    "types": ["test-type"],
+                    "types": [
+                        "Software and Configuration Checks/AWS Security Best Practices/Network Reachability"
+                    ],
                 },
                 "resources": [
                     {

tests/lib/scan/scan_test.py

@@ -27,15 +27,15 @@ finding = generate_finding_output(
     partition="aws",
     description="Description of the finding",
     risk="High",
-    related_url="http://example.com",
+    related_url="",
     remediation_recommendation_text="Recommendation text",
-    remediation_recommendation_url="http://example.com/remediation",
+    remediation_recommendation_url="https://hub.prowler.com/check/test_check",
     remediation_code_nativeiac="native-iac-code",
     remediation_code_terraform="terraform-code",
     remediation_code_other="other-code",
     remediation_code_cli="cli-code",
     compliance={"compliance_key": "compliance_value"},
-    categories=["categorya", "categoryb"],
+    categories=["encryption", "logging"],
     depends_on=["dependency"],
     related_to=["related"],
     notes="Notes about the finding",

tests/providers/aws/lib/s3/s3_test.py

@@ -39,15 +39,15 @@ FINDING = generate_finding_output(
     partition="aws",
     description="Description of the finding",
     risk="High",
-    related_url="http://example.com",
+    related_url="",
     remediation_recommendation_text="Recommendation text",
-    remediation_recommendation_url="http://example.com/remediation",
+    remediation_recommendation_url="",
     remediation_code_nativeiac="native-iac-code",
     remediation_code_terraform="terraform-code",
     remediation_code_other="other-code",
     remediation_code_cli="cli-code",
     compliance={"compliance_key": "compliance_value"},
-    categories=["categorya", "categoryb"],
+    categories=["encryption", "logging"],
     depends_on=["dependency"],
     related_to=["related"],
     notes="Notes about the finding",