prowler

README

Prowler

Customize Prowler

You can customize several settings for Prowler by modifying the prowler.yaml file.

# ignorePlugin
# Specify plugins to be ignored here.
ignorePlugin:
  - entra_global_admin_in_less_than_five_users

# specificPluginSetting
# You can set scores, tags, recommendations, etc. for each plugin.
specificPluginSetting:
  category/pluginName:
    # score (0.1-1.0):
    # Set the score for the plugin
    # If no score is set, the score will be according to Severity
    score: 0.8

    # skipResourceNamePattern:
    # Specify resource name patterns to ignore resources that match these patterns.
    skipResourceNamePattern:
      - "your_resource_uid"

    # ignoreMessagePattern:
    # Specify message patterns to ignore messages that match these patterns.
    ignoreMessagePattern: "Non-privileged user [a-zA-Z0-9-_]+ does not have MFA."

    # tags:
    # You can set tags for resources.
    # Tags can be used for search filters, etc.
    tags:
      - tag1
      - tag2

    # recommend:
    # You can set recommendations.
    recommend:
      risk: "..."
      remediation: "xxxxx"

This configuration allows you to customize Prowler's behavior, including setting ignoring specific plugins, and configuring plugin-specific settings such as scores, resource name patterns to skip, tags, and recommendations.

Generate Prowler YAML file

You can generate the Prowler YAML file using the following command.

$ make generate-yaml

If you want to generate a YAML file with a specific commit hash, specify COMMIT_HASH.

$ COMMIT_HASH=xxxxxxx go run generate-prowler-yaml/main.go

Update your Prowler YAML file

If updating your Prowler YAML, specify the current YAML in PLUGIN_FILE

# Azure plugin
$ PLUGIN_FILE=path/to/your/prowler.yaml \
  PLUGIN_DIR=providers/azure/services \
  COMMIT_HASH=xxxxxxx \
  go run generate-prowler-yaml/main.go

Documentation

Index

• func Ptr[T any](v T) *T
• type PluginRecommend
• type PluginSetting
• type ProwlerSetting
  • func LoadProwlerSetting(path string) (*ProwlerSetting, error)
  • func ParseProwlerSettingYaml(data []byte) (*ProwlerSetting, error)
  • func (c *ProwlerSetting) IsIgnoreMessagePattern(plugin string, messages []string) bool
  • func (c *ProwlerSetting) IsIgnorePlugin(plugin string) bool
  • func (c *ProwlerSetting) IsSkipResourceNamePattern(plugin, resourceName, aliasResourceName string) bool

Functions

func Ptr

func Ptr[T any](v T) *T

Helper function: return pointer of a value

Types

type PluginRecommend

type PluginRecommend struct {
	Risk           *string `yaml:"risk,omitempty"`
	Recommendation *string `yaml:"recommendation,omitempty"`
}

type PluginSetting

type PluginSetting struct {
	Score                   *float32         `yaml:"score,omitempty"`
	SkipResourceNamePattern []string         `yaml:"skipResourceNamePattern,omitempty"`
	IgnoreMessagePattern    []string         `yaml:"ignoreMessagePattern,omitempty" validate:"dive,regexp"`
	Tags                    []string         `yaml:"tags,omitempty"`
	Recommend               *PluginRecommend `yaml:"recommend,omitempty"`
}

type ProwlerSetting

type ProwlerSetting struct {
	IgnorePlugin          []string                 `yaml:"ignorePlugin"`
	SpecificPluginSetting map[string]PluginSetting `yaml:"specificPluginSetting,omitempty" validate:"dive"`
}

func LoadProwlerSetting

func LoadProwlerSetting(path string) (*ProwlerSetting, error)

func ParseProwlerSettingYaml

func ParseProwlerSettingYaml(data []byte) (*ProwlerSetting, error)

func (*ProwlerSetting) IsIgnoreMessagePattern

func (c *ProwlerSetting) IsIgnoreMessagePattern(plugin string, messages []string) bool

func (*ProwlerSetting) IsIgnorePlugin

func (c *ProwlerSetting) IsIgnorePlugin(plugin string) bool

func (*ProwlerSetting) IsSkipResourceNamePattern

func (c *ProwlerSetting) IsSkipResourceNamePattern(plugin, resourceName, aliasResourceName string) bool