prowler 5.17.1__py3-none-any.whl → 5.18.0__py3-none-any.whl

prowler/compliance/m365/cis_4.0_m365.json

@@ -121,7 +121,9 @@
     {
       "Id": "1.2.2",
       "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people.Users with permissions to the group mailbox can send as or send on behalf of the mailbox email address if the administrator has given that user permissions to do that. This is particularly useful for help and support mailboxes because users can send emails from \"Contoso Support\" or \"Building A Reception Desk.\"Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation.The recommended state is `Sign in blocked` for `Shared mailboxes`.",
-      "Checks": [],
+      "Checks": [
+        "exchange_shared_mailbox_sign_in_disabled"
+      ],
       "Attributes": [
         {
           "Section": "1 Microsoft 365 admin center",
@@ -691,7 +693,9 @@
     {
       "Id": "2.4.4",
       "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.",
-      "Checks": [],
+      "Checks": [
+        "defender_zap_for_teams_enabled"
+      ],
       "Attributes": [
         {
           "Section": "2 Microsoft 365 Defender",

prowler/compliance/m365/cis_6.0_m365.json

@@ -121,7 +121,9 @@
     {
       "Id": "1.2.2",
       "Description": "Shared mailboxes are used when multiple people need access to the same mailbox, such as a company information or support email address, reception desk, or other function that might be shared by multiple people. Shared mailboxes are created with a corresponding user account using a system generated password that is unknown at the time of creation. The recommended state is Sign in blocked for Shared mailboxes.",
-      "Checks": [],
+      "Checks": [
+        "exchange_shared_mailbox_sign_in_disabled"
+      ],
       "Attributes": [
         {
           "Section": "1 Microsoft 365 admin center",
@@ -753,7 +755,9 @@
     {
       "Id": "2.4.4",
       "Description": "Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing. When ZAP for Teams protection blocks a message, the message is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP occurs up to 48 hours after delivery.",
-      "Checks": [],
+      "Checks": [
+        "defender_zap_for_teams_enabled"
+      ],
       "Attributes": [
         {
           "Section": "2 Microsoft 365 Defender",

prowler/compliance/m365/iso27001_2022_m365.json

@@ -112,12 +112,13 @@
         }
       ],
       "Checks": [
-        "entra_identity_protection_sign_in_risk_enabled",
-        "entra_identity_protection_user_risk_enabled",
+        "defender_antiphishing_policy_configured",
         "defender_antispam_outbound_policy_configured",
         "defender_malware_policy_notifications_internal_users_malware_enabled",
-        "defender_antiphishing_policy_configured",
-        "entra_admin_users_phishing_resistant_mfa_enabled"
+        "defender_zap_for_teams_enabled",
+        "entra_admin_users_phishing_resistant_mfa_enabled",
+        "entra_identity_protection_sign_in_risk_enabled",
+        "entra_identity_protection_user_risk_enabled"
       ]
     },
     {
@@ -344,15 +345,15 @@
         }
       ],
       "Checks": [
-        "defender_antispam_outbound_policy_configured",
-        "defender_malware_policy_notifications_internal_users_malware_enabled",
-        "defender_malware_policy_common_attachments_filter_enabled",
-        "defender_malware_policy_comprehensive_attachments_filter_applied",
         "defender_antispam_connection_filter_policy_empty_ip_allowlist",
         "defender_antispam_connection_filter_policy_safe_list_off",
         "defender_antispam_outbound_policy_configured",
         "defender_antispam_outbound_policy_forwarding_disabled",
-        "defender_antispam_policy_inbound_no_allowed_domains"
+        "defender_antispam_policy_inbound_no_allowed_domains",
+        "defender_malware_policy_common_attachments_filter_enabled",
+        "defender_malware_policy_comprehensive_attachments_filter_applied",
+        "defender_malware_policy_notifications_internal_users_malware_enabled",
+        "defender_zap_for_teams_enabled"
       ]
     },
     {
@@ -368,11 +369,11 @@
         }
       ],
       "Checks": [
+        "defender_antispam_outbound_policy_configured",
         "defender_malware_policy_common_attachments_filter_enabled",
         "defender_malware_policy_comprehensive_attachments_filter_applied",
         "defender_malware_policy_notifications_internal_users_malware_enabled",
-        "defender_antispam_outbound_policy_configured",
-        "defender_malware_policy_notifications_internal_users_malware_enabled"
+        "defender_zap_for_teams_enabled"
       ]
     },
     {
@@ -691,6 +692,7 @@
         "defender_malware_policy_common_attachments_filter_enabled",
         "defender_malware_policy_comprehensive_attachments_filter_applied",
         "defender_malware_policy_notifications_internal_users_malware_enabled",
+        "defender_zap_for_teams_enabled",
         "teams_external_domains_restricted",
         "teams_external_users_cannot_start_conversations"
       ]

prowler/config/config.py

@@ -38,7 +38,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.17.1"
+prowler_version = "5.18.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
@@ -62,6 +62,7 @@ class Provider(str, Enum):
     MONGODBATLAS = "mongodbatlas"
     ORACLECLOUD = "oraclecloud"
     ALIBABACLOUD = "alibabacloud"
+    OPENSTACK = "openstack"
 
 
 # Compliance

prowler/config/config.yaml

@@ -63,7 +63,10 @@ aws:
   fargate_windows_latest_version: "1.0.0"
 
   # AWS VPC Configuration (vpc_endpoint_connections_trust_boundaries, vpc_endpoint_services_allowed_principals_trust_boundaries)
-  # AWS SSM Configuration (aws.ssm_documents_set_as_public)
+  # AWS SSM Configuration (ssm_documents_set_as_public)
+  # AWS S3 Configuration (s3_bucket_cross_account_access)
+  # AWS EventBridge Configuration (eventbridge_schema_registry_cross_account_access, eventbridge_bus_cross_account_access)
+  # AWS DynamoDB Configuration (dynamodb_table_cross_account_access)
   # Single account environment: No action required. The AWS account number will be automatically added by the checks.
   # Multi account environment: Any additional trusted account number should be added as a space separated list, e.g.
   # trusted_account_ids : ["123456789012", "098765432109", "678901234567"]

prowler/config/openstack_mutelist_example.yaml

@@ -0,0 +1,60 @@
+### Project ID, Check and/or Region can be * to apply for all the cases.
+### Resources and tags are lists that can have either Regex or Keywords.
+### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
+### Use an alternation Regex to match one of multiple tags with "ORed" logic.
+### For each check you can except Project IDs, Regions, Resources and/or Tags.
+###########################  MUTELIST EXAMPLE  ###########################
+Mutelist:
+  Accounts:
+    "example-project-id":  # Your OpenStack project ID
+      Checks:
+        "compute_instance_security_groups_attached":
+          Regions:
+            - "EU-WEST-PAR"
+          Resources:
+            - "prowler-test-fail"  # Mute by instance name
+            - "example-instance-id"  # Mute by instance ID
+          Description: "Mute prowler-test-fail instance in compute_instance_security_groups_attached check"
+        "compute_*":
+          Regions:
+            - "*"
+          Resources:
+            - "test-*"  # Mute all resources starting with "test-"
+          Description: "Mute all test instances for all compute checks"
+        "*":
+          Regions:
+            - "*"
+          Resources:
+            - "dev-instance"
+          Tags:
+            - "environment=dev"  # Mute resources with environment=dev tag
+            - "testing=true"
+          Description: "Mute all resources with specific tags"
+
+    "*":  # Apply to all projects
+      Checks:
+        "compute_instance_security_groups_attached":
+          Regions:
+            - "EU-WEST-PAR"
+          Resources:
+            - "legacy-.*"  # Regex: mute all instances starting with "legacy-"
+          Description: "Mute legacy instances in EU-WEST-PAR region"
+        "*":
+          Regions:
+            - "*"
+          Resources:
+            - "*"
+          Tags:
+            - "prowler-ignore=true"  # Mute any resource with this tag across all checks
+          Description: "Global mute for resources tagged with prowler-ignore=true"
+        "identity_password_policy_enabled":
+          Regions:
+            - "*"
+          Resources:
+            - "*"
+          Exceptions:
+            Accounts:
+              - "production-project-id"
+            Regions:
+              - "US-EAST-1"
+          Description: "Mute identity_password_policy_enabled everywhere EXCEPT in production-project-id in US-EAST-1"

prowler/lib/check/check.py

@@ -687,6 +687,10 @@ def execute(
                 is_finding_muted_args["account_id"] = (
                     global_provider.identity.account_id
                 )
+            elif global_provider.type == "openstack":
+                is_finding_muted_args["project_id"] = (
+                    global_provider.identity.project_id
+                )
             for finding in check_findings:
                 if global_provider.type == "cloudflare":
                     is_finding_muted_args["account_id"] = finding.account_id

prowler/lib/check/models.py

@@ -779,7 +779,10 @@ class CheckReportCloudflare(Check_Report):
 
     @property
     def zone_name(self) -> str:
-        """Zone name."""
+        """Zone name - for DNS records use zone_name attribute, for zones use name."""
+        zone_name = getattr(self._zone, "zone_name", None)
+        if zone_name:
+            return zone_name
         return getattr(self._zone, "name", "")
 
     @property
@@ -792,7 +795,10 @@ class CheckReportCloudflare(Check_Report):
 
     @property
     def region(self) -> str:
-        """Cloudflare is a global service."""
+        """Return zone_name as region for zone-scoped resources, otherwise global."""
+        zone_name = getattr(self._zone, "zone_name", None)
+        if zone_name:
+            return zone_name
         return "global"
 
 
@@ -907,6 +913,25 @@ class CheckReportNHN(Check_Report):
         self.location = getattr(resource, "location", "kr1")
 
 
+@dataclass
+class CheckReportOpenStack(Check_Report):
+    """Contains the OpenStack Check's finding information."""
+
+    resource_name: str
+    resource_id: str
+    project_id: str
+    region: str
+
+    def __init__(self, metadata: Dict, resource: Any) -> None:
+        super().__init__(metadata, resource)
+        self.resource_name = getattr(
+            resource, "name", getattr(resource, "resource_name", "default")
+        )
+        self.resource_id = getattr(resource, "id", getattr(resource, "resource_id", ""))
+        self.project_id = getattr(resource, "project_id", "")
+        self.region = getattr(resource, "region", "global")
+
+
 @dataclass
 class CheckReportMongoDBAtlas(Check_Report):
     """Contains the MongoDB Atlas Check's finding information."""

prowler/lib/cli/parser.py

@@ -27,10 +27,10 @@ class ProwlerArgumentParser:
         self.parser = argparse.ArgumentParser(
             prog="prowler",
             formatter_class=RawTextHelpFormatter,
-            usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,dashboard,iac} ...",
+            usage="prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,dashboard,iac} ...",
             epilog="""
 Available Cloud Providers:
-  {aws,azure,gcp,kubernetes,m365,github,iac,llm,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare}
+  {aws,azure,gcp,kubernetes,m365,github,iac,llm,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack}
     aws                 AWS Provider
     azure               Azure Provider
     gcp                 GCP Provider
@@ -39,6 +39,7 @@ Available Cloud Providers:
     github              GitHub Provider
     cloudflare          Cloudflare Provider
     oraclecloud         Oracle Cloud Infrastructure Provider
+    openstack           OpenStack Provider
     alibabacloud        Alibaba Cloud Provider
     iac                 IaC Provider (Beta)
     llm                 LLM Provider (Beta)

prowler/lib/outputs/finding.py

@@ -366,6 +366,20 @@ class Finding(BaseModel):
                 )
                 output_data["region"] = check_output.region
 
+            elif provider.type == "openstack":
+                output_data["auth_method"] = (
+                    f"Username: {get_nested_attribute(provider, 'identity.username')}"
+                )
+                output_data["account_uid"] = get_nested_attribute(
+                    provider, "identity.project_id"
+                )
+                output_data["account_name"] = get_nested_attribute(
+                    provider, "identity.project_name"
+                )
+                output_data["resource_name"] = check_output.resource_name
+                output_data["resource_uid"] = check_output.resource_id
+                output_data["region"] = check_output.region
+
             # check_output Unique ID
             # TODO: move this to a function
             # TODO: in Azure, GCP and K8s there are findings without resource_name

prowler/lib/outputs/html/html.py

@@ -1160,6 +1160,78 @@ class HTML(Output):
             )
             return ""
 
+    @staticmethod
+    def get_openstack_assessment_summary(provider: Provider) -> str:
+        """
+        get_openstack_assessment_summary gets the HTML assessment summary for the OpenStack provider
+
+        Args:
+            provider (Provider): the OpenStack provider object
+
+        Returns:
+            str: HTML assessment summary for the OpenStack provider
+        """
+        try:
+            project_id = getattr(provider.identity, "project_id", "unknown")
+            project_name = getattr(provider.identity, "project_name", "")
+            region_name = getattr(provider.identity, "region_name", "unknown")
+            username = getattr(provider.identity, "username", "unknown")
+            user_id = getattr(provider.identity, "user_id", "")
+
+            project_name_item = (
+                f"""
+                            <li class="list-group-item">
+                                <b>Project Name:</b> {project_name}
+                            </li>"""
+                if project_name
+                else ""
+            )
+
+            user_id_item = (
+                f"""
+                            <li class="list-group-item">
+                                <b>User ID:</b> {user_id}
+                            </li>"""
+                if user_id
+                else ""
+            )
+
+            return f"""
+                <div class="col-md-2">
+                    <div class="card">
+                        <div class="card-header">
+                            OpenStack Assessment Summary
+                        </div>
+                        <ul class="list-group list-group-flush">
+                            <li class="list-group-item">
+                                <b>Project ID:</b> {project_id}
+                            </li>
+                            {project_name_item}
+                            <li class="list-group-item">
+                                <b>Region:</b> {region_name}
+                            </li>
+                        </ul>
+                    </div>
+                </div>
+                <div class="col-md-4">
+                    <div class="card">
+                        <div class="card-header">
+                            OpenStack Credentials
+                        </div>
+                        <ul class="list-group list-group-flush">
+                            <li class="list-group-item">
+                                <b>Username:</b> {username}
+                            </li>
+                            {user_id_item}
+                        </ul>
+                    </div>
+                </div>"""
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+            )
+            return ""
+
     @staticmethod
     def get_assessment_summary(provider: Provider) -> str:
         """

prowler/lib/outputs/jira/jira.py

@@ -1875,12 +1875,12 @@ class Jira:
                     summary_parts.append(finding.resource_uid)
 
                 summary = " - ".join(summary_parts[1:])
-                summary = f"{summary_parts[0]} {summary}"
+                summary = f"{summary_parts[0]} {summary}"[:255]
 
                 payload = {
                     "fields": {
                         "project": {"key": project_key},
-                        "summary": f"[Prowler] {finding.metadata.Severity.value.upper()} - {finding.metadata.CheckID} - {finding.resource_uid}",
+                        "summary": summary,
                         "description": adf_description,
                         "issuetype": {"name": issue_type},
                         "customfield_10148": {"value": "SDK"},
@@ -2081,7 +2081,7 @@ class Jira:
             if resource_uid:
                 summary_parts.append(resource_uid)
             summary = " - ".join(summary_parts[1:])
-            summary = f"{summary_parts[0]} {summary}"
+            summary = f"{summary_parts[0]} {summary}"[:255]
 
             payload = {
                 "fields": {

prowler/lib/outputs/outputs.py

@@ -32,6 +32,8 @@ def stdout_report(finding, color, verbose, status, fix):
         details = finding.region
     if finding.check_metadata.Provider == "alibabacloud":
         details = finding.region
+    if finding.check_metadata.Provider == "openstack":
+        details = finding.region
     if finding.check_metadata.Provider == "cloudflare":
         details = finding.zone_name
 

prowler/lib/outputs/summary_table.py

@@ -86,6 +86,13 @@ def display_summary_table(
         elif provider.type == "alibabacloud":
             entity_type = "Account"
             audited_entities = provider.identity.account_id
+        elif provider.type == "openstack":
+            entity_type = "Project"
+            audited_entities = (
+                provider.identity.project_name
+                if provider.identity.project_name
+                else provider.identity.project_id
+            )
 
         # Check if there are findings and that they are not all MANUAL
         if findings and not all(finding.status == "MANUAL" for finding in findings):

prowler/lib/timeline/models.py

@@ -0,0 +1,27 @@
+from datetime import datetime
+from typing import Any, Dict, Optional
+
+from pydantic.v1 import BaseModel
+
+
+class TimelineEvent(BaseModel):
+    """A timeline event representing a resource modification.
+
+    Provider-agnostic model that can be used by any timeline implementation
+    (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs, etc.).
+    """
+
+    event_id: str
+    event_time: datetime
+    event_name: str
+    event_source: str
+    actor: str
+    actor_uid: Optional[str] = None
+    actor_type: Optional[str] = None
+    source_ip_address: Optional[str] = None
+    user_agent: Optional[str] = None
+    request_data: Optional[Dict[str, Any]] = None
+    response_data: Optional[Dict[str, Any]] = None
+    error_code: Optional[str] = None
+    error_message: Optional[str] = None
+    metadata: Optional[Dict[str, Any]] = None

prowler/lib/timeline/timeline.py

@@ -0,0 +1,36 @@
+"""Abstract base class for timeline services."""
+
+from abc import ABC, abstractmethod
+from typing import Any, Dict, List, Optional
+
+
+class TimelineService(ABC):
+    """Abstract base class for provider-specific timeline implementations.
+
+    Subclasses should implement the get_resource_timeline method to query
+    their provider's audit/activity log service (e.g., AWS CloudTrail,
+    Azure Activity Logs, GCP Audit Logs).
+    """
+
+    @abstractmethod
+    def get_resource_timeline(
+        self,
+        region: Optional[str] = None,
+        resource_id: Optional[str] = None,
+        resource_uid: Optional[str] = None,
+    ) -> List[Dict[str, Any]]:
+        """Get timeline events for a resource.
+
+        Args:
+            region: Region/location where the resource exists. Implementations
+                    may provide a sensible default for global/regionless resources.
+            resource_id: Provider-specific resource ID (e.g., bucket name, instance ID)
+            resource_uid: Provider-specific unique identifier (e.g., AWS ARN, Azure Resource ID)
+
+        Returns:
+            List of timeline event dictionaries
+
+        Raises:
+            ValueError: If neither resource_id nor resource_uid is provided
+        """
+        raise NotImplementedError