# Prowler App The **Prowler App** is a user-friendly interface for the Prowler CLI, providing a visual dashboard to monitor your cloud security posture. This tutorial will guide you through setting up and using the Prowler App. After [installing](../index.md#prowler-app-installation) the **Prowler App**, access it at [http://localhost:3000](http://localhost:3000). You can also access to the auto-generated **Prowler API** documentation at [http://localhost:8080/api/v1/docs](http://localhost:8080/api/v1/docs) to see all the available endpoints, parameters and responses. ???+ note If you are a [Prowler Cloud](https://cloud.prowler.com/sign-in) user you can see API docs at [https://api.prowler.com/api/v1/docs](https://api.prowler.com/api/v1/docs) ## **Step 1: Sign Up** ### **Sign up with Email** To get started, sign up using your email and password:

### **Sign up with Social Login** If Social Login is enabled, you can sign up using your preferred provider (e.g., Google, GitHub). ???+ note "How Social Login Works" - If your email is already registered, you will be logged in, and your social account will be linked. - If your email is not registered, a new account will be created using your social account email. ???+ note "Enable Social Login" See [how to configure Social Login for Prowler](prowler-app-social-login.md) to enable this feature in your own deployments. --- ## **Step 2: Log In** Once you’ve signed up, log in with your email and password to start using the Prowler App. Log In

You will see the Overview page with no data yet, so let's start adding a provider to scan your cloud environment. --- ## **Step 3: Add a Provider** To run your first scan, you need to add a cloud provider account. Prowler App supports AWS, Azure, GCP, and Kubernetes. 1. Navigate to `Settings > Cloud Providers`. 2. Click `Add Account` to set up a new provider and provide your credentials: Add Provider

--- ## **Step 4: Configure the Provider** Choose the provider you want to scan from the following options: Select a Provider

Once you’ve selected a provider, you need to provide the Provider UID: - **AWS**: Enter your AWS Account ID. - **GCP**: Enter your GCP Project ID. - **Azure**: Enter your Azure Subscription ID. - **Kubernetes**: Enter your Kubernetes Cluster context of your kubeconfig file. Optionally, provide a **Provider Alias** for easier identification. Follow the instructions provided to add your credentials: --- ### **Step 4.1: AWS Credentials** For AWS, enter your `AWS Account ID` and choose one of the following methods to connect: #### **Step 4.1.1: IAM Access Keys** 1. Select `Connect via Credentials`.

2. Enter your `Access Key ID`, `Secret Access Key` and optionally a `Session Token`: AWS Credentials

#### **Step 4.1.2: IAM Role** 1. Select `Connect assuming IAM Role`. AWS Role

2. Enter the `Role ARN` and any optional field like the AWS Access Keys to assume the role, the `External ID`, the `Role Session Name` or the `Session Duration`: AWS Role

???+ note check if your AWS Security Token Service (STS) has the EU (Ireland) endpoint active. If not we will not be able to connect to your AWS account. If that is the case your STS configuration may look like this: AWS Role

To solve this issue, please activate the EU (Ireland) STS endpoint. --- ### **Step 4.2: Azure Credentials** For Azure, Prowler App uses a service principal application to authenticate, for more information about the process of creating and adding permissions to a service principal check this [section](../getting-started/requirements.md#azure). When you finish creating and adding the [Entra](./azure/create-prowler-service-principal.md#assigning-the-proper-permissions) and [Subscription](./azure/subscriptions.md#assign-the-appropriate-permissions-to-the-identity-that-is-going-to-be-assumed-by-prowler) scope permissions to the service principal, enter the `Tenant ID`, `Client ID` and `Client Secret` of the service principal application. Azure Credentials

--- ### **Step 4.3: GCP Credentials** To connect your GCP Project, you need to use the Application Default Credentials (ADC) returned by the `gcloud` CLI. Here’s how to set up: 1. Run the following command in your terminal to authenticate with GCP: ```bash gcloud auth application-default login ``` 2. Once authenticated, get the `Client ID`, `Client Secret` and `Refresh Token` from `~/.config/gcloud/application_default_credentials`. 3. Paste the `Client ID`, `Client Secret` and `Refresh Token` into the Prowler App. GCP Credentials

--- ### **Step 4.4: Kubernetes Credentials** For Kubernetes, Prowler App uses a `kubeconfig` file to authenticate, paste the contents of your `kubeconfig` file into the `Kubeconfig content` field. By default, the `kubeconfig` file is located at `~/.kube/config`.

???+ note If you are adding an **EKS**, **GKE**, **AKS** or external cluster, follow these additional steps to ensure proper authentication: ** Make sure your cluster allow traffic from the Prowler Cloud IP address `52.48.254.174/32` ** 1. Apply the necessary Kubernetes resources to your EKS, GKE, AKS or external cluster (you can find the files in the [`kubernetes` directory of the Prowler repository](https://github.com/prowler-cloud/prowler/tree/master/kubernetes)): ```console kubectl apply -f kubernetes/prowler-sa.yaml kubectl apply -f kubernetes/prowler-role.yaml kubectl apply -f kubernetes/prowler-rolebinding.yaml ``` 2. Generate a long-lived token for authentication: ```console kubectl create token prowler-sa -n prowler-ns --duration=0 ``` - **Security Note:** The `--duration=0` option generates a non-expiring token, which may pose a security risk if not managed properly. Users should decide on an appropriate expiration time based on their security policies. If a limited-time token is preferred, set `--duration=` (e.g., `--duration=24h`). - **Important:** If the token expires, Prowler Cloud will no longer be able to authenticate with the cluster. In this case, you will need to generate a new token and **remove and re-add the provider in Prowler Cloud** with the updated `kubeconfig`. 3. Update your `kubeconfig` to use the ServiceAccount token: ```console kubectl config set-credentials prowler-sa --token= kubectl config set-context --user=prowler-sa ``` Replace with the generated token and with your KubeConfig Context Name of your EKS, GKE or AKS cluster. 4. Now you can add the modified `kubeconfig` in Prowler Cloud. Then simply test the connection. --- ### **Step 4.5: M365 Credentials** For M365, Prowler App uses a service principal application with user and password to authenticate, for more information about the requirements needed for this provider check this [section](../getting-started/requirements.md#microsoft-365). Also, the detailed steps of how to add this provider to Prowler Cloud and start using it are [here](./microsoft365/getting-started-m365.md). Prowler Cloud M365 Credentials

--- ## **Step 5: Test Connection** After adding your credentials of your cloud account, click the `Launch` button to verify that the Prowler App can successfully connect to your provider:

## **Step 6: Scan started** After successfully adding and testing your credentials, Prowler will start scanning your cloud environment, click on the `Go to Scans` button to see the progress: Start Now

???+ note Prowler will automatically scan all configured providers every **24 hours**, ensuring your cloud environment stays continuously monitored. --- ## **Step 7: Monitor Scan Progress** Track the progress of your scan in the `Scans` section:

--- ## **Step 8: Analyze the Findings** While the scan is running, start exploring the findings in these sections: - **Overview**: High-level summary of the scans.

- **Compliance**: Insights into compliance status.

- **Issues**: Types of issues detected. Issues

- **Browse All Findings**: Detailed list of findings detected, where you can filter by severity, service, and more.

To view all `new` findings that have not been seen prior to this scan, click the `Delta` filter and select `new`. To view all `changed` findings that have had a status change (from `PASS` to `FAIL` for example), click the `Delta` filter and select `changed`. ## **Step 9: Download the Outputs** Once a scan is complete, navigate to the Scan Jobs section to download the output files generated by Prowler:

These outputs are bundled into a single .zip archive containing: - CSV report - JSON-OSCF formatted results - HTML report - A folder with individual compliance reports ???+ note "Note" The Download button only becomes active after a scan completes successfully. Download output

The `zip` file unpacks into a folder named like `prowler-output--`, which includes all of the above outputs. In the example below, you can see the `.csv`, .`json`, and `.html` reports alongside a subfolder for detailed compliance checks. Output folder

???+ note "API Note" For more information about the API endpoint used by the UI to download the ZIP archive, refer to: [Prowler API Reference - Download Scan Output](https://api.prowler.com/api/v1/docs#tag/Scan/operation/scans_report_retrieve) ## **Step 10: Download specified compliance report** Once your scan has finished, you don’t need to grab the entire ZIP—just pull down the specific compliance report you want: - Navigate to the **Compliance** section of the UI. Compliance section

- Find the Framework report you need. - Click its **Download** icon to retrieve that report’s CSV file with all the detailed findings. Download compliance output

???+ note "API Note" To fetch a single compliance report via API, see the Retrieve compliance report as CSV endpoint in the Prowler API Reference.[Prowler API Reference - Retrieve compliance report as CSV](https://api.prowler.com/api/v1/docs#tag/Scan/operation/scans_compliance_retrieve)