Skip to content

Prowler 5.3.0

Latest
Latest
Compare
Choose a tag to compare
@paabloLC paabloLC released this 11 Feb 17:06
· 7 commits to v5.3 since this release
5.3.0
45d359c

🎨 UI

Improved UX in Forms

  • Enhanced the sign-in and sign-up forms to provide a smoother user experience.
  • Improved form validation and error handling for better clarity and guidance.

🚀 Real-Time Scan Visibility

  • New! 🎉 Scans now appear immediately after launching them, eliminating the previous delay.
  • When setting up a provider and initiating the first scan, it will be displayed right away instead of requiring users to wait several minutes.
  • This improvement provides instant feedback and a more seamless experience when running scans.

💻 API

🕐 Scheduled Scans

  • Daily scheduled scan instances are now created beforehand with SCHEDULED state, making scheduled scans visible before launching them.

🔎 Findings

  • Findings endpoints now require at least one date filter to get all the findings.
  • Findings metadata endpoint received a performance improvement.

☁️ Providers

  • Increased the allowed length of the provider UID for Kubernetes providers to support AWS EKS, Azure AKS and GCP GKE.

🔧 SDK

Microsoft365 Provider 🎉

We’re excited to announce that Prowler now supports Microsoft365 as a new cloud provider! This release introduces several dedicated security and compliance checks tailored for Microsoft365 environments. These new assessments help you identify configuration gaps, enforce best practices, and maintain a strong security posture across your Microsoft365 deployments.

This is only available in Prowler CLI and will be added to the API and UI 🔜

Try it out now with: prowler microsoft365 {--sp-env-auth | --az-cli-auth | --browser-auth} 🚀

Choose the authentication method that best suits your needs:

  1. Service Principal Credentials: Uses a registered app in Entra (formerly Azure AD) with client credentials (tenant ID, client ID and client secret).
  2. Azure CLI: Uses your logged-in Azure CLI session.
  3. Interactive Browser: Opens a browser window to sign in manually.

Five new checks ❗

This release includes several new security and compliance checks designed specifically for Microsoft365 environments:

  • admincenter_groups_not_public_visibility
  • admincenter_settings_password_never_expire
  • admincenter_users_admins_reduced_license_footprint
  • admincenter_users_between_two_and_four_global_admins
  • entra_thirdparty_integrated_apps_not_allowed

You can see all the Microsoft365 checks with prowler microsoft365 --list-checks

📖 1 new Compliance Framework

  • CIS (Center for Internet Security) Microsoft 365 Foundations Benchmark v4.0.0

New AWS Check ✅

We’ve added a new security check in AWS KMS:

  • kms_cmk_not_multi_region

This check ensures that KMS Customer Managed Keys (CMKs) are not multi-region, helping enforce security best practices for key management.

🎉 Special thanks to our external contributor wunzeco for this contribution!

Full Changelog: 5.2.3...5.3.0

Assets 2
Loading