> ## Documentation Index > Fetch the complete documentation index at: https://docs.prowler.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP. # Changelog > New features and improvements in each Prowler release ### 🎫 Finding Groups - Jira This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Selected Findings, Finding Groups, and mixed selections can now be sent to Jira. When you select multiple findings, choose between one grouped issue or separate issues. Generated issues keep their Prowler context with deep links and filter details, while the UI provides clear dispatch and failure feedback. Send findings to Jira Read more in the [Jira integration documentation](/user-guide/tutorials/prowler-app-jira-integration). ### πŸ•ΈοΈ Attack Paths - Queries This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Prowler Cloud now records which built-in Attack Paths queries returned data at the end of each scan. The query selector hides confirmed-empty queries for the selected scan, so you can focus on paths that exist without opening blank graph views. Errored, unknown, and parameterized queries remain available when they still require investigation or input. All Attack Paths queries are now published on [Prowler Hub](https://hub.prowler.com), where you can browse the full catalog. Attack Paths query selector Read more in the [Attack Paths documentation](/user-guide/tutorials/prowler-app-attack-paths). ### πŸ§‘β€πŸ« New Tutorials: Connect Your AI Agents to Prowler Cloud This feature needs a Prowler Cloud API key, so it is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). New tutorials walk you through connecting your own AI agents to Prowler Cloud, so they can query your security posture and act on it programmatically. Read more in the [AI agents documentation](/user-guide/ai-agents/index). ### ☁️ Region-less Oracle Cloud Infrastructure Setup Oracle Cloud Infrastructure (OCI) provider credentials no longer require a region. Existing clients can still send the legacy `region` field for compatibility, but the API ignores it before storing credentials or starting a scan. This removes an unnecessary step from OCI onboarding. Read more in the [OCI documentation](/user-guide/providers/oci/getting-started-oci). ### πŸ” Checks #### AWS * `sagemaker_notebook_instance_no_secrets` scans the `OnCreate` and `OnStart` lifecycle scripts of SageMaker notebook instances for hardcoded API keys, passwords, tokens, connection strings, and other secrets. Thanks to @kiranrajsg! Read more in the [AWS documentation](/user-guide/providers/aws/getting-started-aws). Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws). ### πŸ” Security * Integration responses and operations now respect provider visibility, preventing hidden-provider disclosure and blocking unauthorized attachment, connection checks, Jira dispatches, edits, and deletion. * Next.js was updated from 16.2.9 to 16.2.11, patching four high-severity and five medium-severity vulnerabilities. * The unused `npm` CLI was removed from the UI container image, eliminating the bundled `node-tar` CVE-2026-59873 and reducing exposure to future bundled npm vulnerabilities. * Vitest and its browser packages were updated from 4.1.8 to 4.1.10, resolving the critical `@vitest/browser` file-access permission bypass. These are development dependencies and have no runtime impact. * Kubernetes kubeconfig validation now blocks legacy `auth-provider.config.cmd-path` command authentication, closing a command-execution bypass. * `next-auth` was updated from 5.0.0-beta.30 to 5.0.0-beta.32, patching two critical Auth.js advisories: existence-based authorization checks that could fail open when a provider is misconfigured, and a homoglyph `@` bypass in email address normalization. The bump also pulls in the patched `@auth/core` 0.41.3 transitively. ### πŸ™Œ External Contributors Thank you to our community contributors for this release! * @kiranrajsg: AWS `sagemaker_notebook_instance_no_secrets` check ([#11843](https://github.com/prowler-cloud/prowler/pull/11843)) * @owenchenxy: Alibaba Cloud SSH and RDP security group checks now handle capitalized `Policy="Accept"` values correctly ([#12049](https://github.com/prowler-cloud/prowler/pull/12049)) * @rsaladra: S3 bucket name validation no longer raises an invalid escape sequence `SyntaxWarning` at startup ([#12041](https://github.com/prowler-cloud/prowler/pull/12041)) * @SujayKulkarni-2211: Updated the AWS check count in the README ([#12011](https://github.com/prowler-cloud/prowler/pull/12011)) See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.36.0) for the complete list of changes. ### πŸ’¬ Lighthouse AI - Side Chat This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Lighthouse AI now lives in a side panel you can open from anywhere in the app. Ask about the findings you are looking at without leaving the page, and expand to the full-page chat at any time: your draft, messages, and streaming response come along. Finding and resource details share the same panel, with tabs to switch between Details and Lighthouse AI. Lighthouse AI side chat Read more in the [Lighthouse AI documentation](/getting-started/products/prowler-cloud-lighthouse#side-panel). ### πŸ€– Lighthouse AI - Take Action This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Lighthouse AI is no longer read-only. Ask it to do things and it will: connect or remove providers, trigger a scan, schedule daily scans, update scan settings, and manage your mutelist and mute rules, straight from the chat. Every action is gated by RBAC: Lighthouse can only do what the user asking could do themselves. Read more in the [Lighthouse AI capabilities](/getting-started/products/prowler-cloud-lighthouse#capabilities). ### ☁️ One-step AWS Organizations onboarding This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Onboarding an entire AWS Organization is now a single step. One CloudFormation quick-create link deploys the management account role and a service-managed StackSet that rolls the role out to every member account, replacing the manual StackSet console setup. Target the whole organization or a specific Organizational Unit or Root ID, and deploy from the management account or a delegated administrator. The S3 integration quick-create link also pre-fills the bucket owner account ID, preventing a stack validation error. AWS Organizations onboarding wizard Built on the full-organization CloudFormation template contributed by @jchrisfarris β€” thanks! Read more in the [AWS Organizations documentation](/user-guide/tutorials/prowler-cloud-aws-organizations). ### 🎯 Scan configurations: exclude checks and services This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Scan configurations now accept `excluded_checks` and `excluded_services` to narrow the execution scope. Skip individual checks or entire services per provider, and the scan does not run them at all: less noise, faster scans, and no findings you would mute anyway. Read more in the [Scan Configuration documentation](/user-guide/tutorials/prowler-app-scan-configuration#limiting-the-scan-scope). ### 🧭 Redesigned sidebar navigation The sidebar was redesigned around how you actually work: grouped sections for security, settings, and help, a Home/Chat switch at the top, collapsible configuration entries, clearer active states, and a responsive mobile overlay. Redesigned sidebar ### πŸ”Œ Prowler MCP tools renamed to `prowler_*` Core Prowler tools in Prowler MCP moved from the `prowler_app_*` prefix to the shorter `prowler_*` namespace, and the MCP documentation was restructured around it. Legacy `prowler_app_*` names keep working in Lighthouse AI, so existing setups are not broken. Read more in the [Prowler MCP tools reference](/getting-started/basic-usage/prowler-mcp-tools). ### πŸ” Security * Jira integration credentials now only accept bare Atlassian site names (letters, numbers, and hyphens), and Jira tenant information requests validate site names and no longer follow redirects. * Social account linking now requires a verified matching email from both the identity provider and the existing user account, and account connection notification emails are disabled. * 13 advisories reported by `pnpm audit` on the UI (3 high, 9 moderate, 1 low) are resolved with patched versions of `hono`, `ws`, `vite`, `dompurify`, `js-yaml`, `@opentelemetry/core`, and `@babel/core`, including `hono` CVE-2026-59896. ### πŸ™Œ External Contributors No external contributors in this release. Special mention to @jchrisfarris, whose full-organization CloudFormation template from v5.34.0 powers the new one-step AWS Organizations onboarding ([#10403](https://github.com/prowler-cloud/prowler/pull/10403)). See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.35.0) for the complete list of changes. ### 🏷️ New product names The Prowler family has grown, and the names now say what each product is. Same products, clearer names: **Prowler products:** * **Prowler Cloud** β€” the managed cloud security platform operated by the Prowler team. * **Prowler Private Cloud** (formerly *Prowler Enterprise*) β€” the self-hosted deployment of Prowler Cloud in your own environment. * **Prowler Hub** β€” the free public library of versioned checks, cloud service artifacts, and compliance frameworks. * **Prowler Lighthouse AI** β€” The Agentic Cloud Defender in Prowler Cloud and Prowler Private Cloud. * **Prowler MCP** β€” the MCP server that connects AI assistants and agents to Prowler, including the IDE plugins. **Open source projects:** * **Prowler CLI** β€” the command-line scanner for all supported providers. * **Prowler Local Server** (formerly *Prowler App*) β€” the self-hosted web application and API to run scans, visualize findings, and manage providers. * **Prowler Local Dashboard** β€” the web dashboard for visualizing Prowler CLI scan results, distributed with the CLI. * **Prowler SDK** β€” the Python library behind Prowler CLI and Prowler Local Server. See the full family in the [Prowler products documentation](/getting-started/products). ### 🧭 Cross-Provider Compliance This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). One framework, every cloud, a single answer. The new **Cross-provider** tab in Compliance takes the most recent completed scan of every compatible provider and rolls them up into a single compliance posture per framework, with a per-provider breakdown and a combined executive PDF report. Requirement status follows strict precedence (FAIL over PASS over MANUAL), so one failing provider is enough to flag a requirement across your whole estate. Cross-provider compliance overview Three universal frameworks support it today: * **CIS Controls 8.1** β€” AWS, Azure, Google Cloud, Microsoft 365, Kubernetes, GitHub, Google Workspace, Okta, Oracle Cloud, Alibaba Cloud, Cloudflare, MongoDB Atlas, OpenStack, and Vercel. * **CSA CCM 4.0** β€” AWS, Azure, Google Cloud, Alibaba Cloud, and Oracle Cloud. * **DORA 2022/2554** β€” AWS, Azure, Google Cloud, Alibaba Cloud, and Cloudflare. Filter by provider type, account, or provider group, drill into each framework's requirements, and export the combined PDF. Cross-provider compliance detail Read more in the [Cross-Provider Compliance documentation](/user-guide/compliance/tutorials/cross-provider-compliance). ### 🏒 New Provider β€” E2E Networks Prowler now scans [**E2E Networks**](https://www.e2enetworks.com/), with **27 checks** spanning compute nodes, networking, security groups, load balancers, block and file storage, and managed databases. Thanks to @deepak7093 for their 1st provider in Prowler! Available in the Prowler CLI: ```bash theme={null} export E2E_NETWORKS_API_KEY="your-api-key" export E2E_NETWORKS_AUTH_TOKEN="your-auth-token" export E2E_NETWORKS_PROJECT_ID="your-project-id" prowler e2enetworks ``` Read more in the [E2E Networks documentation](/user-guide/providers/e2enetworks/getting-started-e2enetworks). Explore all E2E Networks checks at [Prowler Hub](https://hub.prowler.com/check?provider=e2enetworks). ### πŸ” Security User role relationship updates in the API are now limited to the active tenant, preserving the role assignments the same user holds in other tenants. ### πŸ” Checks #### AWS * `ec2_ami_account_block_public_access` β€” verifies AMI block public access is enabled at the account level in each Region, so AMIs cannot be shared publicly. Thanks to @goutham-hari! * `datapipeline_pipeline_no_secrets_in_definition` β€” scans Data Pipeline object fields, parameter objects, and parameter values for hardcoded secrets with Kingfisher. Thanks to @YinkaMetrics! * `elbv2_listener_pqc_tls_enabled` β€” verifies ELBv2 HTTPS/TLS listeners use post-quantum TLS security policies with TLS 1.2 or higher, helping reduce harvest-now-decrypt-later exposure. * `amplify_app_no_secrets_in_environment` β€” scans Amplify app and branch environment variables and build settings (buildSpec) for hardcoded secrets with Kingfisher. Thanks to @Deep070203! #### Azure * `app_function_ensure_http_is_redirected_to_https` β€” verifies that Function Apps enforce HTTPS-only traffic. Thanks to @amandalal007! #### Kubernetes * `core_minimize_hostpath_volume_mounts` β€” detects Pods that use `hostPath` volumes. Thanks to @0xTaoZ! * `core_readonly_root_filesystem_enabled` β€” verifies that every container in each Pod explicitly sets `readOnlyRootFilesystem: true` in its security context. Thanks to @Weedle02! #### STACKIT * `iaas_server_public_ip_attached` β€” flags IaaS servers that have a public IP address directly attached to a network interface. Thanks to @johannes-engler-mw! Explore all checks at [Prowler Hub](https://hub.prowler.com/check). ### πŸ™Œ External Contributors Thank you to our community contributors for this release! * @jchrisfarris β€” Deploy AWS Organizations with the CloudFormation template in one step ([#10403](https://github.com/prowler-cloud/prowler/pull/10403)) * @deepak7093 β€” New E2E Networks provider: 27 checks across compute nodes, networking, security groups, load balancers, block/file storage, and managed databases ([#11654](https://github.com/prowler-cloud/prowler/pull/11654)) * @goutham-hari β€” AWS `ec2_ami_account_block_public_access` check ([#11828](https://github.com/prowler-cloud/prowler/pull/11828)) * @YinkaMetrics β€” AWS `datapipeline_pipeline_no_secrets_in_definition` check ([#11821](https://github.com/prowler-cloud/prowler/pull/11821)) * @amandalal007 β€” Azure `app_function_ensure_http_is_redirected_to_https` check ([#11929](https://github.com/prowler-cloud/prowler/pull/11929)) * @0xTaoZ β€” Kubernetes `core_minimize_hostpath_volume_mounts` check ([#11837](https://github.com/prowler-cloud/prowler/pull/11837)) * @Weedle02 β€” Kubernetes `core_readonly_root_filesystem_enabled` check ([#11835](https://github.com/prowler-cloud/prowler/pull/11835)) * @johannes-engler-mw β€” STACKIT `iaas_server_public_ip_attached` check ([#11549](https://github.com/prowler-cloud/prowler/pull/11549)) * @janderik β€” Trailing newlines added to compliance, region, and fixture data files for POSIX compliance ([#11765](https://github.com/prowler-cloud/prowler/pull/11765)) * @Deep070203 β€” AWS `amplify_app_no_secrets_in_environment` check ([#11825](https://github.com/prowler-cloud/prowler/pull/11825)) See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.34.0) for the complete list of changes. ### πŸ€– Lighthouse AI β€” The Agentic Cloud Defender This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Lighthouse AI is now a full agentic assistant wired to the Prowler Cloud backend. Ask it about your findings, your compliance posture, or your riskiest resources, and watch it work: the agent discovers and runs the Prowler tools it needs to answer, with every tool call visible in the new agentic view. It reads your security data through read-only tools, so it can never touch secrets or modify your tenant. Lighthouse AI agentic view The chat experience is rebuilt around **persistent sessions**: conversations stream in real time, stay in your session history, can be archived, and a **sidebar chat mode** lets you ask questions from any page in the app without losing your place. Lighthouse AI sessions You control the brain behind it. Configure one or more LLM providers β€” **OpenAI**, **Amazon Bedrock**, or any **OpenAI-compatible** endpoint (OpenRouter, Ollama) β€” with connection testing built into the setup and per-provider model selection. Add a shared **business context** (your security goals, compliance needs, organizational priorities) and every session uses it to give answers that fit your environment. Lighthouse AI LLM providers Read more in the [Lighthouse AI documentation](/getting-started/products/prowler-cloud-lighthouse) and the [multiple LLM providers guide](/user-guide/tutorials/prowler-cloud-lighthouse-multi-llm). ### πŸ“„ Compliance PDF Reports Without Credentials Compliance PDF reports no longer require the provider's credentials to be present. Findings are now enriched from the provider metadata stored in the database, so a report still generates even after the provider secret has been deleted or its credentials have become invalid. Read more in the [compliance documentation](/user-guide/compliance/tutorials/compliance). ### ⏳ Scan Queueing Overlapping scans for the same provider now queue behind the active one instead of dispatching concurrent scan workers. Launch a manual scan while a scheduled one is running and it waits its turn. No more duplicated work or racing scans. ### πŸ” Security The Kubernetes provider credentials now reject kubeconfigs using `exec` authentication in Prowler Cloud, at the API and in the credential form, preventing user-supplied commands from running on Cloud workers. Read more in the [Kubernetes provider authentication documentation](/user-guide/providers/kubernetes/getting-started-k8s#step-2-configure-kubernetes-authentication). ### πŸ™Œ External Contributors Thank you to our community contributors for this release! * @kratos0718 β€” Azure `postgresql_flexible_server_log_retention_days_greater_3` Flexible Server log retention fix ([#11761](https://github.com/prowler-cloud/prowler/pull/11761)) * @Sanjays2402 β€” `KeyError: 'MANUAL'` crash fix in the compliance summary table, shipped early in v5.32.1 ([#11823](https://github.com/prowler-cloud/prowler/pull/11823)) See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.33.0) for the complete list of changes. ### πŸ”Ž Findings Triage This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Triage findings straight from the Findings view. Each finding gets a triage status you can move through its lifecycle: **Open β†’ Under Review β†’ Remediating β†’ Risk Accepted β†’ False Positive β†’ Resolved** Add a triage note to record the decision, mute a finding, all from the row's actions menu. The current status shows inline on every finding row, so you keep track of what has been reviewed and stop re-checking the same issues scan after scan. Findings triage statuses The status also follows the finding automatically across scans: when a finding flips from `FAIL` to `PASS` on the next scan it moves to **Resolved**, and when it flips from `PASS` back to `FAIL` it moves to **Reopened**. You always know whether an issue is genuinely fixed or has regressed, without touching it by hand. Findings triage lifecycle Read more in the [Findings Triage documentation](/user-guide/tutorials/prowler-app-findings-triage). ### βš™οΈ Scan Configuration This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Create named, reusable scan configurations from a dedicated **Scans / Configuration** page. Each configuration is YAML that follows the structure of [`prowler/config/config.yaml`](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml), so you only include the keys you want to override; the rest fall back to the built-in defaults. Values are validated on save against a per-provider, type-safe configuration schema that range-checks each field and rejects unknown keys, so a malformed config is caught before it ever reaches a scan. Attach a configuration to one or more providers so it applies on their next scan, or save it now and attach providers later. Scan configuration editor From the Providers view you can pick which configuration a provider uses (`Default` or any of your saved ones) without leaving the page. No more passing config files around by hand. Scan configuration per provider Read more in the [Scan Configuration documentation](/user-guide/tutorials/prowler-app-scan-configuration). ### βœ… Per-Requirement Configuration Validation This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing). Compliance frameworks can now declare `ConfigRequirements` on a requirement, so it's reported as **FAIL** when its mapped checks ran under a configuration too loose to satisfy it. Even if every individual finding PASSed. This applies across all compliance outputs: CSV, OCSF, and console tables, and is the engine behind Scan Configuration's "marked as FAIL" behavior described above. Per-requirement configuration validation Read more in the [Configuration File documentation](/user-guide/cli/tutorials/configuration_file). ### ⏱️ Okta β€” Request Throttling & Retries Prowler now proactively throttles Okta API requests to stay under rate limits, with reactive retries on HTTP 429 as a safety net. Both are set in the scan configuration (or their equivalent CLI flags): * `okta_requests_per_second` (config file) / `--okta-requests-per-second` (CLI) β€” cap the request rate. Default: 4 req/s. * `okta_max_retries` (config file) / `--okta-retries-max-attempts` (CLI) β€” bound retry attempts. Default: 5. This makes large Okta scans more reliable and less likely to be rate-limited. Read more in the [Okta rate limit documentation](/user-guide/providers/okta/retry-configuration#request-throttling-requests-per-second). ### πŸ“‰ AWS β€” Cap Resources Scanned per Service Large AWS accounts can now cap how many resources Prowler analyzes for the highest-volume services, keeping scan time and cost under control. Set a global limit with `max_scanned_resources_per_service`, or override it per service: * EBS snapshots (`max_ebs_snapshots`) * Backup recovery points (`max_backup_recovery_points`) * CloudWatch log groups (`max_cloudwatch_log_groups`) * Lambda functions (`max_lambda_functions`) * ECS task definitions (`max_ecs_task_definitions`) * CodeArtifact packages (`max_codeartifact_packages`) Limits are **disabled by default** (`0` = unlimited); only positive values cap the analyzed resources. When a positive limit is set, compliance results reflect only the sampled resources, not every matching resource in the account. Read more in the [configuration file documentation](/user-guide/cli/tutorials/configuration_file#supported-aws-resource-limits). ### 🏷️ Azure β€” Filter by Resource Group Azure scans can now be scoped to one or more resource groups with the new `--azure-resource-group` / `--azure-resource-groups` option. This lets you run focused assessments against specific environments, teams, or workloads instead of scanning every accessible resource in the subscription. Thanks to @Legin-ML for contributing this feature! ```bash theme={null} # Single resource group prowler azure --az-cli-auth --azure-resource-group rg-prod # Multiple resource groups prowler azure --az-cli-auth --azure-resource-group rg-prod1 rg-prod2 ``` Read more in the [Azure Resource Groups documentation](/user-guide/providers/azure/resource-groups). ### 🧭 Provider Group Filter Filter the **Overview, Findings, Resources, Scans, and Providers** views by provider group. Scope the whole app to a team, an environment, or a business unit in one click instead of filtering provider by provider. Provider group filter Read more about managing provider groups in the [RBAC documentation](/user-guide/tutorials/prowler-app-rbac). ### πŸ”¬ API β€” Timestamp Precision in Findings Filters The `/api/v1/findings` endpoint now accepts full timestamps on the `inserted_at` and `updated_at` filters (`filter[inserted_at__gte]`, `filter[inserted_at__lte]`, and the `updated_at` variants), so you can query narrow time windows instead of whole days. Date-only filtering keeps working, so existing integrations are unaffected. ```bash theme={null} # Findings inserted within a precise timestamp window curl --globoff \ 'http://localhost:8080/api/v1/findings?filter[inserted_at__gte]=2026-07-01T06:12:18Z&filter[inserted_at__lte]=2026-07-02T19:25:55Z' \ -H 'Authorization: Bearer ' \ -H 'Accept: application/vnd.api+json' ``` ### πŸ•ΈοΈ Attack Paths β€” Neptune as a persistent sink Attack Paths can now persist its graph in **AWS Neptune** in addition to Neo4j, selectable via `ATTACK_PATHS_SINK_DATABASE=neptune` (default `neo4j`). Cartography's per-scan ingest database stays on Neo4j. The scan task preflights the ingest database and the configured sink before ingestion, and provider graph cleanup now deletes relationships in directed batches before deleting nodes. This is the groundwork for scale: a managed graph database lets Attack Paths hold much larger graphs, extend coverage to more providers, and link resources across them so an attack path can cross provider boundaries instead of stopping at one cloud's edge. Read more in the [Attack Paths documentation](/user-guide/tutorials/prowler-app-attack-paths). ### πŸ” New Secret-Scanning Engine β€” Kingfisher Prowler's secret-scanning checks now run on [Kingfisher](https://github.com/mongodb/kingfisher) instead of `detect-secrets`. Scans run **fully offline by default**, and obvious placeholder values (e.g. `password123`, `changeme`) are no longer reported, cutting down false positives. Opt in to **live validation** with the new `--scan-secrets-validate` flag (or the `aws.secrets_validate` config option): Prowler checks discovered secrets against the provider APIs, and any secret confirmed to be **live is reported as critical**, so you can prioritize the credentials that actually work. The `detect_secrets_plugins` configuration option has been removed, as it is no longer used by the new engine. Read more in the [secret detection documentation](/user-guide/cli/tutorials/pentesting#detect-secrets). ### πŸ” Checks #### AWS * `stepfunctions_statemachine_encrypted_with_cmk` β€” Step Functions state machines use a customer-managed KMS key for encryption at rest instead of the default AWS-owned key. Thanks to @Sid-0602! * `waf_regional_webacl_logging_enabled` β€” AWS WAF Classic Regional Web ACLs have logging enabled to a Kinesis Data Firehose stream. Thanks to @Sid-0602! * **IAM privilege escalation** β€” the privesc checks now cover **AWS Bedrock AgentCore** paths across Runtime, Harness, Code Interpreter, and Custom Browser. Thanks to @MrCloudSec! * `apigateway_restapi_no_secrets_in_stage_variables` β€” scans API Gateway REST API stage variables for hardcoded passwords, API keys, and tokens. Thanks to @chirag1206! * `awslambda_function_no_secrets_in_code` β€” this check now supports a `secrets_ignore_files` audit-config option to skip files inside the deployment package by glob pattern (e.g. `*.deps.json`), suppressing .NET dependency-manifest false positives without masking real secrets. * `s3_bucket_object_public` β€” spot-checks a configurable sample of object ACLs in each bucket and flags objects granted to the `AllUsers` or `AuthenticatedUsers` groups. Disabled by default; opt in via the `s3_bucket_object_public_enabled` configuration option. Thanks to @Synchx00! #### Microsoft 365 New **Conditional Access** hardening checks: * `entra_conditional_access_policy_explicitly_targets_azure_devops` β€” at least one enabled policy explicitly includes the Azure DevOps cloud application, rather than relying on a broad "All cloud apps" policy. Thanks to @mzl2233! * `entra_conditional_access_policy_no_exclusion_gaps` β€” every user, group, role, or application excluded from an enabled policy stays in scope of another enabled policy. Thanks to @UTKARSH698 with @arieleli01212 as co-author! * `entra_conditional_access_policy_groups_management_restricted` β€” every security group referenced by an enabled or report-only policy is management-restricted or role-assignable. Thanks to @SAMurai-16! * `exchange_application_access_policy_restricts_mailbox_apps` β€” every service principal with Microsoft Graph application-level Exchange mailbox permissions is restricted by an Exchange Online Application Access Policy. Thanks to @VasistAcharya! ### πŸ“š Compliance #### CIS Benchmark Refresh β€” Six New Versions Prowler ships a coordinated refresh of the CIS Benchmarks across six providers: * **AWS** β€” CIS Amazon Web Services Foundations Benchmark v7.0.0, adding the new Organizations section (2.1.1-2.1.6), resource policy (2.21), web front-end access logging (4.10), and VPC Endpoints (6.8) recommendations. * **Azure** β€” CIS Microsoft Azure Foundations Benchmark v6.0.0. * **GCP** β€” CIS Google Cloud Platform Foundation Benchmark v5.0.0. * **Kubernetes** β€” CIS Kubernetes Benchmark v2.0.1. * **GitHub** β€” CIS GitHub Benchmark v1.2.0. * **Microsoft 365** β€” CIS Microsoft 365 Foundations Benchmark v7.0.0. #### CIS Controls v8.1 β€” Universal Framework A new **universal** (cross-provider) compliance framework mapping existing checks across 18 providers β€” AWS, Azure, GCP, Kubernetes, M365, GitHub, AlibabaCloud, OracleCloud, GoogleWorkspace, Okta, Cloudflare, Vercel, MongoDB Atlas, OpenStack, Linode, StackIT, NHN, and Scaleway β€” to the 18 CIS Critical Security Controls and their Safeguards. Ships with a dedicated detail view and report mapping in the UI. Read more in the [compliance documentation](/user-guide/compliance/tutorials/compliance). Explore the full compliance catalog at [Prowler Hub](https://hub.prowler.com/compliance). ### πŸ™Œ External Contributors Thank you to our community contributors for this release! * @chirag1206 β€” `apigateway_restapi_no_secrets_in_stage_variables` check ([#11188](https://github.com/prowler-cloud/prowler/pull/11188)) * @MrCloudSec β€” AWS Bedrock AgentCore privilege escalation paths in the IAM privesc checks ([#11726](https://github.com/prowler-cloud/prowler/pull/11726)) * @Sid-0602 β€” `stepfunctions_statemachine_encrypted_with_cmk` ([#11538](https://github.com/prowler-cloud/prowler/pull/11538)) and `waf_regional_webacl_logging_enabled` ([#11539](https://github.com/prowler-cloud/prowler/pull/11539)) checks * @mzl2233 β€” `entra_conditional_access_policy_explicitly_targets_azure_devops` check ([#11182](https://github.com/prowler-cloud/prowler/pull/11182)) * @UTKARSH698 with @arieleli01212 as co-author β€” `entra_conditional_access_policy_no_exclusion_gaps` check ([#11577](https://github.com/prowler-cloud/prowler/pull/11577)) * @SAMurai-16 β€” `entra_conditional_access_policy_groups_management_restricted` check ([#11342](https://github.com/prowler-cloud/prowler/pull/11342)) * @vahidg β€” Azure PostgreSQL flexible server collection resilience fix ([#11595](https://github.com/prowler-cloud/prowler/pull/11595)) * @davletd β€” Azure `keyvault_logging_enabled` `AuditEvent` category fix ([#11660](https://github.com/prowler-cloud/prowler/pull/11660)) * @VasistAcharya β€” `exchange_application_access_policy_restricts_mailbox_apps` ([#11247](https://github.com/prowler-cloud/prowler/pull/11247)) * @Legin-ML β€” Filter scans at Resource Group level ([#10657](https://github.com/prowler-cloud/prowler/pull/10657)) * @Synchx00 β€” `s3_bucket_object_public` check ([#9517](https://github.com/prowler-cloud/prowler/pull/9517)) See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.32.0) for the complete list of changes. ### πŸ—“οΈ Flexible Scan Scheduling Available exclusively in **Prowler Cloud**. Prowler Local Server supports daily scans only. Scan scheduling from the Providers page You can now set a per-provider scan schedule from the Providers page. Pick a **scan time** and a **repeat cadence**: Daily, Every 48 hours, Weekly (with a day-of-week selector), or Monthly. Schedules can be edited or removed at any time, and a new scan never interrupts access to existing data. Schedule editor All schedules are listed in one place under the **Scheduled** tab in **Scan Jobs**, showing each provider's cadence, next scan, and last scan at a glance. Scheduled tab in Scan Jobs Read more in the [scan scheduling documentation](/user-guide/tutorials/prowler-scan-scheduling). ### πŸ“š DORA β€” Expanded Provider Coverage Prowler extends [**DORA**](https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en) (Digital Operational Resilience Act, Regulation (EU) 2022/2554) coverage to **Azure**, **GCP**, **Cloudflare**, and **Alibaba Cloud**, mapping each provider's existing checks across the five DORA pillars. DORA compliance for Alibaba Cloud The framework follows the `_` naming convention as `DORA_2022_2554`. Read more in the [compliance documentation](/user-guide/compliance/tutorials/compliance). ### πŸš€ Guided Onboarding Available exclusively in **Prowler Cloud**. New accounts now get a guided first-run experience. The Overview greets you with an **"Add your first provider"** prompt: connect a provider so Prowler has something to scan and assess, then get started in one click (or skip for now). Guided onboarding prompt From there, contextual empty states across the product point you to the next action rather than leaving you stuck. Attack Paths, for example, explains that you need a completed scan before it can build a graph and links straight to **Scan Jobs**, with a **"See how it works"** affordance for first-timers. Contextual empty states ### πŸ” Optional SAML SSO `userType` The SAML `userType` attribute is now optional. If your IdP does not send it, or sends it blank, Prowler keeps the user's existing roles unchanged instead of replacing them with a fallback role. When `userType` is provided, Prowler still maps the user to the matching role. If that role does not exist yet, Prowler creates it with read-only access: visibility over all providers, with no management permissions. Read more in the [SAML SSO documentation](/user-guide/tutorials/prowler-app-sso). ### 🏒 New Provider β€” Linode Prowler now scans [**Linode**](https://www.linode.com/) (Akamai Cloud), covering its administration, compute, and networking services. Thanks to @varunmamillapalli for their 1st provider in Prowler! Linode is not officially supported. For more information, [contact us](https://prowler.com/contact). Read more in the [Linode documentation](/user-guide/providers/linode/getting-started-linode). Explore all Linode checks at [Prowler Hub](https://hub.prowler.com/check?provider=linode). ### πŸ” Checks #### AWS **Post-Quantum Cryptography readiness** β€” get ahead of the migration to quantum-resistant cryptography: * `cloudfront_distributions_pqc_tls_enabled` β€” CloudFront distributions enforce a post-quantum TLS 1.3 security policy. * `apigateway_domain_name_pqc_tls_enabled` β€” API Gateway custom domain names use a post-quantum TLS security policy. * `transfer_server_pqc_ssh_kex_enabled` β€” Transfer Family servers use a post-quantum hybrid SSH key exchange. * `acmpca_certificate_authority_pqc_key_algorithm` β€” Private CA authorities use a post-quantum (ML-DSA) key algorithm (new `acmpca` service). * `rolesanywhere_trust_anchor_pqc_pki` β€” IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI (new `rolesanywhere` service). **Organization-wide governance:** * `securityhub_delegated_admin_enabled_all_regions` β€” Security Hub has a delegated administrator, active in all opted-in regions, with organization auto-enable on. Thanks to @ernestprovo23! * `config_delegated_admin_and_org_aggregator_all_regions` β€” AWS Config has a delegated administrator and an organization aggregator covering all regions. Thanks to @ernestprovo23! **Machine learning:** * `sagemaker_clarify_exists` β€” verifies at least one SageMaker Clarify processing job exists per scanned region, so bias-detection and model-explainability controls are in place. Thanks to @AlexanderSanin! #### Azure A large batch of new Azure checks spanning data, compute, identity, and networking: * **Cosmos DB** β€” automatic failover, continuous backup policy, minimum TLS 1.2, and public network access disabled. * **MySQL & PostgreSQL Flexible Servers** β€” geo-redundant backup and high availability. * **AKS** β€” auto-upgrade, Azure Monitor (Container Insights), local accounts disabled, and Microsoft Defender enabled. * **Databricks** β€” public network access disabled and secure cluster connectivity (no public IP). * **Defender** β€” CSPM on the Standard tier. * **Networking** β€” NSG association on subnets and DDoS Network Protection on VNets. * **Entra ID** β€” app registration credential expiry, users with recent sign-in and strong authentication enforcement. * **Recovery Services** β€” vaults with at least one protected backup item and vaults with adequate backup policy. Thanks to @s1ns3nz0 for all these contributions! #### GCP New coverage for high availability and public-exposure detection: * `cloudsql_instance_high_availability_enabled` β€” Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover. * `cloudfunction_function_inside_vpc` β€” Cloud Functions use a Serverless VPC Access connector for private egress. * `cloudfunction_function_not_publicly_accessible` β€” detects `allUsers` / `allAuthenticatedUsers` IAM invocation bindings. * `secretmanager_secret_not_publicly_accessible` β€” detects Secret Manager secrets with public IAM bindings. * `secretmanager_secret_rotation_enabled` β€” verifies Secret Manager secrets have automatic rotation configured with a period of 90 days or less and no missed rotation. Thanks to @s1ns3nz0 for all these contributions! #### Kubernetes New core checks for container resource governance and reliability: CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes. Thanks to @Nikhilkumar2311 for all these contributions! #### Microsoft 365 * `entra_directory_sync_object_takeover_blocked` β€” hybrid Entra tenants block cloud object takeover through soft-match and hard-match directory synchronization. Thanks to @PrettyFox0 and @omobolajiadeyan! * `entra_conditional_access_policy_no_deleted_object_references` β€” flags Conditional Access policies that reference user, group, or role objects that no longer resolve in the directory. Thanks to @ernestprovo23! #### Oracle Cloud Infrastructure * `identity_storage_service_level_admins_scoped` β€” CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions. Explore all checks at [Prowler Hub](https://hub.prowler.com/check). ### 🐍 Python 3.13 Support The Prowler SDK now supports **Python 3.13**. Thanks to @branchv! ### πŸ” Security Updates * **SDK** β€” `pytest` 8.3.5 β†’ 9.0.3, `black` 25.1.0 β†’ 26.3.1, `microsoft-kiota-*` β†’ 1.9.9, and `aiohttp` β†’ 3.14.0, patching known CVEs. * **API** β€” `aiohttp` β†’ 3.14.0 and `idna` β†’ 3.15, patching known CVEs. * **UI** β€” bumped vulnerable `Next.js`, React, AI SDK, `postcss`, `hono`, `qs`, `esbuild`, and Alpine OpenSSL packages; `dompurify` 3.4.2 β†’ 3.4.10, patching XSS sanitization bypass advisories. * **Containers** β€” base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs). ### πŸ™Œ External Contributors Thank you to our community contributors for this release! * @varunmamillapalli β€” New Linode provider: administration, compute, and networking services ([#11633](https://github.com/prowler-cloud/prowler/pull/11633)) * @s1ns3nz0 β€” 20+ Azure & GCP checks across Cosmos DB, AKS, Databricks, Flexible Servers, Entra, networking, and GCP public-exposure * @Nikhilkumar2311 β€” Kubernetes resource limits, requests, image tag, and probe checks ([#11373](https://github.com/prowler-cloud/prowler/pull/11373)) * @ernestprovo23 β€” AWS Security Hub/Config org-wide delegated admin checks ([#11259](https://github.com/prowler-cloud/prowler/pull/11259)) and M365 conditional access check ([#11236](https://github.com/prowler-cloud/prowler/pull/11236)) * @AlexanderSanin β€” `sagemaker_clarify_exists` check ([#11211](https://github.com/prowler-cloud/prowler/pull/11211)) * @PrettyFox0 with @omobolajiadeyan as co-author β€” M365 directory sync object takeover check ([#11098](https://github.com/prowler-cloud/prowler/pull/11098)) * @branchv β€” Python 3.13 support ([#9293](https://github.com/prowler-cloud/prowler/pull/9293)) * @alinealfa β€” GCP audit-filtered aggregated sinks fix ([#11575](https://github.com/prowler-cloud/prowler/pull/11575)) * @b-abderrahmane β€” Configurable Celery worker concurrency ([#11075](https://github.com/prowler-cloud/prowler/pull/11075)) See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.31.0) for the complete list of changes. Release notes for v5.30.0 and earlier, along with every patch release, are on [GitHub Releases](https://github.com/prowler-cloud/prowler/releases).