Prowler — The Cyber Toolchain

Prowler 5.47.0

Thu, 29 Oct 2026 14:14:59 GMT

Prowler adds Azure Application Gateway WAF/HTTP2 checks, subscription owner verification, and MCP tool intent annotations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Prowler adds `network_application_gateway_waf_enabled` and `network_application_gateway_http2_enabled` checks for Azure Application Gateways and their WAF policies, mapped to CIS 5.0 and 6.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Prowler adds `iam_subscription_owners_between_2_and_3` check for Azure to verify each subscription has between two and three principals with the Owner role, including owners inherited from management groups, mapped to CIS 5.0 and 6.0. • Prowler's MCP Server now annotates every tool with `readOnlyHint` and `destructiveHint` so MCP clients can distinguish read-only listing calls from writes; mute rule and mutelist writes are marked destructive. • Prowler's Issues list now leads with the verdict, shows the attack path under each title, and adds a 'Why' column with five evidence legs; the menu entry is renamed to 'Exploitability issues'. • Prowler's add-provider wizard now connects every provider — AWS, Azure, GCP, Microsoft 365, GitHub, Alibaba Cloud, and Cloudflare — in one step, with teammate invitations available for all providers and Lighthouse AI assistance beside the wizard. • Prowler's AWS security group internet exposure checks now treat CIDRs in a single ingress rule that together cover `0.0.0.0/0` or `::/0` (such as `0.0.0.0/1` plus `128.0.0.0/1`) as open to the internet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.46.0

Mon, 26 Oct 2026 19:07:00 GMT

Prowler 5.46.0 adds an Issues page, GCP Vertex AI Workbench checks, new AWS Bedrock/Cognito/WAFv2 checks, PHP runtime coverage, and edition-aware Google Workspace findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `bedrock_guardrail_sensitive_information_filter_enforced`, which flags Bedrock guardrails whose PII entities or custom regexes take no action on the output path, and `bedrock_model_invocation_logging_text_data_enabled`, which verifies that model invocation logging delivers prompt and response text instead of only naming a destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `cognito_user_pool_account_recovery_sms_not_preferred` check, which verifies that Cognito user pools do not rank SMS first for account recovery. • Adds `wafv2_webacl_managed_rule_groups_enabled` check, which verifies that WAFv2 Web ACLs reference at least one managed rule group. • Adds a new GCP `vertexai` service with five Workbench checks — `vertexai_workbench_instance_public_ip_disabled`, `vertexai_workbench_instance_root_access_disabled`, `vertexai_workbench_instance_terminal_access_disabled`, `vertexai_workbench_instance_file_download_disabled`, and `vertexai_workbench_instance_auto_upgrade_enabled` — mapped to PCI DSS 4.0 and CCC MLDE requirements. • Adds new PHP version checks across platforms: a new GCP `appengine` service with the `appengine_version_php_runtime_supported` check flagging App Engine serving versions on PHP runtimes without security fixes, the `elasticbeanstalk_environment_php_platform_updated` check flagging Elastic Beanstalk PHP environments on branches without security fixes or outdated platform versions, and the `lightsail_instance_php_blueprint_updated` check flagging Lightsail instances created from PHP blueprints for manual verification of the PHP release. • Improves Azure App Service runtime checks: raises the default `php_latest_version` for `app_ensure_php_version_is_latest` from `8.2` to `8.5` in both the SDK and the Prowler App scan configuration template, and makes `app_ensure_php_version_is_latest`, `app_ensure_python_version_is_latest`, and `app_ensure_java_version_is_latest` pass any runtime at or above the configured minimum instead of failing every version newer than the configured one. • Adds an Issues page and overview cards in Prowler Cloud, grouping scan findings into issues with verdicts, verdict filters, accessible issue details, and scoped finding evidence. • Improves Google Workspace checks and findings: findings now state when a feature is not available on the tenant edition (e.g. Drive DLP rules, session control, shared drive sharing on Business Starter), requiring the optional `apps.licensing` scope, and checks now pass with the reason stated when an app is turned off for everyone and no organizational unit or group re-enables it. • Improves `bedrock_api_key_no_long_term_credentials` to report Bedrock long-term API keys that never expire (keys created without an expiration period were previously skipped and produced no finding). • Restricts `GET /resources/metadata`, `GET /resources/metadata/latest`, `GET /findings/metadata`, and `GET /findings/metadata/latest` to honour the provider groups of the caller role instead of aggregating every provider in the tenant. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.44.0

Tue, 29 Sep 2026 13:05:06 GMT

Prowler 5.44.0 adds partial resource re-checks, S3-compatible storage via DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL, and PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS for retry control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v1/scans` support for `resource_uids` (up to 10 resources) to launch partial scans, with `is_partial` exposed on scan objects and a `filter[is_partial]` query parameter on scan list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL` environment variable to direct scan output uploads and downloads at S3-compatible object storage such as MinIO, without polluting process-wide AWS environment variables. • Adds `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to control Boto3 retry attempts for the AWS provider; set to `0` to disable retries entirely. • Adds `prowler_trigger_scan` MCP tool support for a `resource_uids` argument to launch partial scans, and exposes `is_partial` on `prowler_list_scans` and `prowler_get_scan` with an `is_partial` filter on `prowler_list_scans`. • Adds a 'Re-check resource' action in the Findings page actions menu and resource detail drawer, launching a partial scan that re-runs only the checks that last reported on that resource. • Connects AWS accounts in a single wizard step: the account ID is read from the role ARN (or typed for static access keys), the role is assumed, and credentials are stored and tested in one submit. • Unifies latest-scan resolution across all endpoints so findings, compliance, and mute rules always read from the same scan for a given provider. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.43.0

Mon, 21 Sep 2026 14:36:47 GMT

Prowler 5.43.0 adds FedRAMP 20x 2026 frameworks, seven AWS Inspector/FIPS checks, partition failover, and a self-registration toggle⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `fedramp_20x_ksi_2026` universal compliance framework covering the 46 FedRAMP Key Security Indicators across AWS, Azure, GCP, Kubernetes, and M365 from a single definition, replacing the pilot per-provider frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `fedramp_20x_frr_class_c_2026` universal compliance framework covering 158 FedRAMP Class C provider rules across AWS, Azure, GCP, Kubernetes, and M365. • Adds seven new AWS checks: `inspector2_coverage_scan_status_active`, `inspector2_coverage_recently_scanned` (configurable via `inspector2_max_days_since_last_scan`, default 3), `inspector2_active_findings_no_known_exploited_vulnerabilities`, `inspector2_active_findings_kev_within_due_date`, `inspector2_active_findings_within_max_age` (configurable via `inspector2_active_finding_max_age_days`, default 192), `elbv2_listener_fips_tls_enabled`, and `transfer_server_fips_security_policy_enabled`. • Adds `inspector2:BatchGetFindingDetails` to the Prowler additions policy and CloudFormation scan role so KEV checks can pull CISA Known Exploited Vulnerability data directly from Inspector without an external feed; missing permission reports `MANUAL` instead of a false `FAIL`. • Adds `UI_SELF_REGISTRATION_ENABLED` environment variable for Prowler Private Cloud deployments; set to `false` to make sign-up invitation-only, hiding the 'Sign up' link and 'Create organization' option. • Adds `DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL` environment variable to sign report download URLs against a browser-reachable storage host, enabling downloads on deployments where object storage is only reachable inside the container network. • Adds `smn_topic_subscriptions` check for Huawei Cloud, reporting SMN topics that have no subscriptions configured. • Adds AWS partition bootstrap failover: when `PROWLER_AWS_PARTITION` is set, bootstrap STS calls try up to two additional regions in the partition on connection errors or timeouts, so GovCloud scans succeed on networks that route only to one regional endpoint. • Adds registry marketplace and external provider onboarding for Private Cloud, with permission-based access, schema-driven credentials, connection checks, and scan launch. • Expired invitations are now re-invitable: a pending invitation past its expiry is marked expired and a new invitation is created for the same email rather than returning a generic error; `filter[state__in]` on the invitations endpoint no longer returns a server error. Breaking changes: • The pilot framework IDs `fedramp_20x_ksi_low_aws`, `fedramp_20x_ksi_low_azure`, and `fedramp_20x_ksi_low_gcp` are replaced by `fedramp_20x_ksi_2026`; any automation or stored results referencing the pilot IDs must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.42.0

Fri, 11 Sep 2026 09:58:47 GMT

Prowler 5.42.0 adds AWS ISO partition support, configurable Boto3 timeouts, and a persistent Trivy vulnerability database cache.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--aws-connect-timeout` and `--aws-read-timeout` CLI flags, plus `PROWLER_AWS_BOTO3_CONNECT_TIMEOUT` and `PROWLER_AWS_BOTO3_READ_TIMEOUT` environment variables, to control per-call AWS API wait times; `--aws-retries-max-attempts 0` now disables Boto3 retries entirely instead of silently falling back to three attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for AWS ISO partitions (`aws-iso`, `aws-iso-b`, `aws-iso-e`, `aws-iso-f`) in the service region matrix, so ISO regions such as `us-isob-east-1` are accepted by `--region` and `--excluded-region` without a hand-edited `aws_regions_by_service.json`. • Honors `TRIVY_CACHE_DIR` in the Image provider so the Trivy vulnerability database is downloaded once and reused across scans; pairing it with `TRIVY_SKIP_DB_UPDATE=true` enables air-gapped image scanning against a pre-populated database. • Lowers the default Boto3 connect timeout from 60 seconds to 10 seconds, cutting scan time in restricted-egress networks (VPC endpoints, GovCloud, private deployments) where unreachable service endpoints previously cost up to four 60-second attempts per region. • Adds a compliance catalog integrity test that enforces unique requirement IDs, no duplicate check references within a requirement, and that every referenced check exists for its provider, spanning 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes, and Microsoft 365. • Bootstraps STS calls in the configured region when `PROWLER_AWS_PARTITION` is set and the region belongs to that partition, preventing routing failures in deployments that reach AWS only through their own VPC endpoints. Breaking changes: • The default Boto3 connect timeout is lowered from 60 seconds to 10 seconds; scans that relied on the longer default to reach slow or high-latency AWS endpoints may now time out where they previously succeeded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.41.0

Wed, 02 Sep 2026 11:38:24 GMT

Prowler 5.41.0 adds 10 new AWS checks, CIS Google Workspace v1.4.0, private-registry scanning, and browser-based findings import • Adds `PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS` environment variable accepting a comma-separated list of IPs and CIDRs to allow the Image provider to reach on-premises registries while keeping all other non-public addresses blocked by the SSRF guard. • Adds `--registry-insecure` flag propagation to Trivy via `TRIVY_INSECURE`, enabling pull and scan of images behind self-signed certificates on trusted internal registries. • Adds `agentcore_log_group_name_prefixes` key to `config.yaml` to configure which CloudWatch log group prefixes the new `cloudwatch_log_group_agentcore_data_protection_policy_enabled` check evaluates. • Adds `DJANGO_UI_BASE_URL` API environment variable; when set, Jira issues created from findings include a direct link back to the finding filtered by its UID. • New check `iam_policy_passrole_to_bedrock_agentcore_restricted` flags customer-managed IAM policies that allow `iam:PassRole` over every role where the passed role can reach Bedrock AgentCore. • New check `iam_policy_no_agentcore_workload_access_token_wildcard` flags customer-managed IAM policies granting `bedrock-agentcore:GetWorkloadAccessToken`, `GetWorkloadAccessTokenForJWT`, or `GetWorkloadAccessTokenForUserId` on resources reaching workload identities beyond the caller's own. • New check `cloudwatch_log_group_agentcore_data_protection_policy_enabled` verifies Bedrock AgentCore log groups have a CloudWatch Logs data protection policy masking sensitive data. • New check `guardduty_runtime_monitoring_enabled` flags GuardDuty detectors without unified Runtime Monitoring (covering EC2, ECS on Fargate, and EKS). • New check `guardduty_ai_protection_enabled` flags GuardDuty detectors without AI Protection for Bedrock, Bedrock AgentCore, and SageMaker AI CloudTrail data events. • New check `ecr_registry_enhanced_scanning_enabled` verifies the ECR registry uses enhanced scanning (Amazon Inspector with continuous rescanning) instead of basic scanning. • New check `eks_cluster_vpc_cni_network_policy_enforced` flags EKS clusters whose Amazon VPC CNI managed add-on does not enforce Kubernetes network policy. • New check `iam_role_service_trust_restricts_source_to_account` flags IAM roles whose trust policy allows an AWS service principal to assume the role without a source-account constraint. • New check `elasticbeanstalk_environment_no_secrets_in_configuration` scans Elastic Beanstalk environment option settings for hardcoded secrets. • New check `memorydb_cluster_in_transit_encryption_enabled` verifies MemoryDB clusters have in-transit encryption (TLS) enabled. • Ships the CIS Google Workspace Foundations Benchmark v1.4.0 compliance framework with reworked checks covering Gmail spoofing, 2-Step Verification, password expiration, and alert severity defaults. • Jira issues created from findings now carry labels `prowler`, `prowler-`, `prowler-`, `prowler-`, and `prowler-finding-` for JQL filtering and automation matching. • Adds browser-based 'Import Findings' dialog on the Scans page (Prowler Cloud and Private Cloud) accepting `.ocsf.json` reports via drag-and-drop or file picker, with inline job-completion and error reporting (requires Manage Ingestions permission). • MCP server tools now report failures as proper MCP tool execution errors (`isError: true`) instead of successful responses carrying an `{"error": ...}` payload; affects `prowler_docs_search`, `prowler_docs_get_document`, `prowler_hub_get_check_code`, `prowler_hub_get_check_fixer`, and `prowler_get_compliance_framework_state_details`. • Image provider registry scans now enumerate repositories in parallel, skip non-image OCI artifacts (Helm charts, cosign signatures, SBOM attestations), and continue scanning remaining images when Trivy fails on a single image. • Image provider authentication now falls back to Basic when a registry rejects a bearer token, and upgrades to bearer when the server responds with a Bearer challenge to a Basic or anonymous request. • Slack integration connection check now displays its result (including the refused or reached channels) directly on the integration card, not only in a transient toast notification (Prowler Cloud only). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.40.0

Fri, 28 Aug 2026 10:48:54 GMT

Prowler 5.40.0 adds 15 new checks across 7 providers, NCSC Cyber Essentials 3.3, and Slack alert destinations • New `ecr_repository_image_no_secrets` check scans the latest image of each ECR repository — both configuration and filesystem layers — for hardcoded secrets. • New `bedrock_guardrail_contextual_grounding_filter_enabled` check verifies that Bedrock guardrails enable both contextual grounding filters, blocking unsupported or off-topic responses. • New `bedrock_custom_model_encrypted_with_cmk` check verifies that Bedrock custom models are encrypted at rest with a customer-managed KMS key rather than an AWS-owned key. • New `bedrock_knowledge_base_encrypted_with_cmk` check verifies that each Bedrock knowledge-base data source encrypts transient chunking/embedding storage with a customer-managed KMS key. • New `bedrock_agent_role_not_shared_across_agents` check verifies that every Bedrock agent has a dedicated execution role so no agent inherits another's permissions. • New `rolesanywhere_profile_restricts_session_permissions` check flags IAM Roles Anywhere profiles that reference an administrative role without scoping down vended sessions via a session policy or managed policies. • New `iam_workload_identity_pool_provider_attribute_condition` check (GCP) flags Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals. • New `organization_default_workflow_permissions_read_only` check (GitHub) verifies that workflows receive a read-only default `GITHUB_TOKEN` at the organization level. • New `repository_default_workflow_permissions_read_only` check (GitHub) verifies that workflows receive a read-only default `GITHUB_TOKEN` at the repository level. • New `organization_actions_pull_request_approval_disabled` check (GitHub) verifies that organizations prevent GitHub Actions from creating and approving pull requests. • New `defender_domain_dmarc_records_published` check (Microsoft 365) verifies that every Exchange Online domain publishes a DMARC record with an enforcing policy (`p=quarantine` or `p=reject`). • New `oss_bucket_versioning_enabled` check (Alibaba Cloud) verifies that OSS buckets have versioning enabled for recovery from accidental or malicious object overwrite and deletion. • New `oss_bucket_server_side_encryption_enabled` check (Alibaba Cloud) verifies that OSS buckets define a default server-side encryption rule (AES256 or KMS). • New `vpc_security_group_open_egress` check (Huawei Cloud) flags VPC security groups that allow open egress to the internet. • New `ske_cluster_no_public_endpoint` check (STACKIT) flags SKE clusters whose Kubernetes API endpoint is publicly reachable because the ACL extension is disabled or its allowed CIDR list contains `0.0.0.0/0` or `::/0`. • Adds NCSC Cyber Essentials 3.3 (Requirements for IT Infrastructure v3.3, April 2026) as a universal compliance framework with 28 requirements across five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection — with Azure provider coverage for 16 requirements. • Slack workspace integration (Prowler Cloud / Prowler Private Cloud): connect a workspace from the Integrations page, authorize destination channels, and select them in alert rules alongside email recipients; the alerts list shows both in a unified 'Destinations' column. • Lighthouse AI answers now support thumbs-up/thumbs-down feedback with an optional free-text detail field, collected per answer directly in the chat. • Providers table now shows an 'Imported provider' indicator for providers whose findings were uploaded via the Prowler CLI, distinguishing them from connected providers at a glance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.39.0

Thu, 13 Aug 2026 09:20:55 GMT

Prowler 5.39.0 adds CMMC 2.0, Azure Management Group onboarding, 20+ M365 checks, and two new AWS hardcoded-secret detections. • Adds `batch_job_definition_no_secrets` check for AWS, scanning Batch job definition environment variables and command parameters for hardcoded secrets. • Adds `awslambda_layer_no_secrets_in_content` check for AWS, scanning Lambda layer package content for hardcoded secrets. • Adds `GET /api/v1/users/me` membership relationships now identify the active tenant with `meta.active` for both JWT and API key authentication. • Adds `prowler_send_findings_to_jira` MCP tool gains Cloud-only grouped dispatch: select failed findings by check IDs against the latest completed scan and send one Jira work item per check listing up to 50 affected resources, with per-group error reporting. • Adds CMMC 2.0 as a universal compliance framework covering all 149 requirements across Levels 1, 2, and 3, mapped to checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365. • Adds 20 new Microsoft 365 Entra ID checks for CIS Microsoft 365 Foundations Benchmark v7.0.0, covering password protection, default user permissions, Conditional Access, sessions and authentication methods, and PIM and access reviews. • Adds Azure Management Group onboarding in Prowler Cloud: onboard all subscriptions under a tenant at once by entering the Microsoft Entra tenant ID and authenticating with a single tenant-wide service principal (Cloud/Private Cloud only). • Adds Lighthouse AI Skills menu on every finding in Prowler Cloud, offering Contextual Fix, Triage Decision, Systemic Scope, and a free-form prompt, with follow-up actions including creating a Jira issue or muting the finding (Cloud/Private Cloud only). • Adds 'Resolved' triage status for `MANUAL` findings in Prowler Cloud, recording written evidence and verifying the finding as an effective `PASS` for 90 days or until a real failure is detected (Cloud/Private Cloud only). • Adds eight organization MCP tools to the Prowler Cloud MCP server, enabling agents to onboard and manage entire AWS Organizations, GCP organizations, and Azure tenant root management groups end to end (Cloud/Private Cloud only). • Redesigns the Attack Paths graph to group same-class resources into expandable nodes with counts and terminates every path in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory (Cloud/Private Cloud only). • Adds Manage Lighthouse AI role permission in role forms and role details, allowing the Lighthouse AI configuration permission to be granted or restricted independently of other permissions (Cloud/Private Cloud only). • Surfaces pre-configured credential creation links in the add-provider wizard: Cloudflare exposes a User API Token template and an Account-Owned template pinned to the entered Cloudflare Account ID; GitHub exposes a personal-repositories template and an organization-scanning template pinned to the entered identifier. • Scales `organization_repository_creation_limited` GitHub check severity to low when repository creation is limited to private or internal visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.38.0

Thu, 06 Aug 2026 13:13:05 GMT

Prowler 5.38.0 adds 20 Attack Paths privilege-escalation queries, 12 M365 checks, SAML multi-domain SSO, and compliance watchlists. • Adds `admincenter_shared_bookings_disabled` check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9. • Adds `defender_priority_account_protection_enabled` and `defender_strict_preset_security_policy_enabled` checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2. • Adds `exchange_owa_mailbox_policy_personal_accounts_disabled` and `exchange_organization_reject_direct_send_enabled` checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5. • Adds `teams_external_access_trial_tenants_blocked` check for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 control 8.2.4. • Adds `entra_device_registration_join_restricted`, `entra_device_registration_max_devices_per_user_limited`, `entra_device_registration_global_admins_not_local_admins`, `entra_device_registration_registering_user_not_local_admin`, `entra_device_registration_laps_enabled`, and `entra_policy_default_user_cannot_read_bitlocker_keys` checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 device registration controls (5.1.4.x). • Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service `iam:PassRole` escalations across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, and Step Functions, plus CodeDeploy/Step Functions existing-resource abuse, permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection. • Attack Paths query metadata now exposes an outcome category (Code execution, Privilege escalation, Public exposure, or Resource inventory) on the queries endpoint, enabling terminal outcome nodes in the graph. • `iam_policy_allows_privilege_escalation` check gains 22 additional escalation combinations from pathfinding.cloud across AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, and EventBridge Scheduler. • Compliance Watchlist (Prowler Cloud/Private Cloud) lets teams pin frameworks from any compliance view, filter the Compliance section to pinned frameworks only, and see pinned framework scores on the Overview page. • SAML SSO now supports one primary email domain plus up to 19 additional domains under a single Identity Provider configuration and a single stable ACS URL (Prowler Cloud/Private Cloud). • Users table in Prowler Cloud now shows each account's sign-in methods as tags, including email/password, Google, GitHub, SAML with linked domains, and Partner SSO. • Prowler API, UI, SDK, and MCP container images now publish per-architecture SBOMs and build-provenance attestations as OCI attestations. • Grype now runs alongside Trivy across container-image security gates, blocking on fixable high and critical findings. • API and SDK container builds now verify checksums of downloaded PowerShell, Trivy, and zizmor binaries before installation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.38.0

Thu, 06 Aug 2026 13:13:05 GMT

Prowler 5.37.0

Mon, 03 Aug 2026 15:53:22 GMT

Prowler 5.37.0 adds Huawei Cloud, 11 Nitro Enclave checks, 4 attack-path queries, MCP integrations/users/roles, and OCSF MITRE ATT&CK enrichment. • Adds `HUAWEICLOUD_ACCESS_KEY_ID` and `HUAWEICLOUD_SECRET_ACCESS_KEY` environment variables to authenticate a new `huaweicloud` provider, enabling `prowler huaweicloud` scans across 25 checks covering CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF, plus the CIS Huawei Cloud Foundations Benchmark 1.0. • Adds 11 new AWS Nitro Enclaves CSPM checks: five `ec2_confidential_workload_host_*` checks for parent-instance hygiene (IMDSv2, public IP, ingress, vsock proxy ports, host state) and six `kms_key_enclave_*` checks for KMS attestation-policy correctness, mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK. • Adds four AWS privilege-escalation Attack Path queries: `STS-002` (cross-account role trust), `STS-003` (wildcard role trust), `IAM-022` (user permissions-boundary removal), and `SSO-001` (IAM Identity Center permission-set escalation). • Adds `codecommit_repository_no_secrets` check (and new `codecommit` service) to scan files at the tip of each repository's default branch for hardcoded secrets. • Adds `glue_catalog_connection_no_secrets` check to detect secrets in Glue Data Catalog connection properties. • Adds `sagemaker_endpoint_config_kms_encryption_enabled` check to verify SageMaker endpoint configurations use a KMS key for storage volume encryption. • Populates `finding_info.analytic` and `finding_info.attacks` in OCSF detection finding output with Prowler check rules and MITRE ATT&CK technique/tactic objects for findings that carry MITRE ATT&CK compliance metadata. • Extends Prowler MCP Server (Cloud and self-hosted Local) with three new tool families: Integrations (full lifecycle for Amazon S3, AWS Security Hub, and Jira — create, update, re-check, delete, and dispatch findings as Jira work items), Users (list tenant users and identify the authenticated user), and Roles (browse RBAC roles, inspect capabilities, and set a user's role). • Adds a `prowler_cloud_*` namespace of 32 Cloud-only MCP tools (exposed at `https://mcp.prowler.com/mcp`) covering Alerts (create/manage alert rules, dry-run conditions, browse fired-alert history), Findings Triage (set triage status and attach notes), Scan Scheduling (daily, interval, weekly, or monthly recurring scans per provider or bulk), and Scan Configurations (build reusable configs and attach to providers). • Lighthouse AI (Prowler Cloud/Private Cloud) is now context-aware: messages carry the current page, open finding or resource, and its metadata, and Lighthouse can now invoke all MCP tool families (scan configurations, scheduling, finding triage, alert rules, integrations, users, and roles) subject to RBAC. • Compliance view in Prowler Cloud now groups frameworks across all providers of the same type, rolling up into a consolidated posture with per-provider breakdown, findings drill-down, and combined executive PDF report; tabs are renamed to `Single Scan` and `Multiple Scans`, with `Multiple Scans` as the new default. • GCP Organization onboarding in Prowler Cloud is now a single guided flow: provide an org-level credential, select folders and projects from a hierarchy tree, set aliases, test the connection, and register each project as a provider. • Attack Paths query info panel now links every query to its page on Prowler Hub. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.37.0

Mon, 03 Aug 2026 15:53:22 GMT

Prowler 5.36.0

Fri, 24 Jul 2026 11:44:08 GMT

Prowler 5.36.0 adds SageMaker secrets detection, grouped Jira dispatch, cleaner Attack Paths UI, and regionless OCI onboarding. • New `sagemaker_notebook_instance_no_secrets` check scans SageMaker notebook instance `OnCreate` and `OnStart` lifecycle scripts for hardcoded API keys, passwords, tokens, and connection strings. • Grouped Jira workflows (Prowler Cloud/Private Cloud): send selected findings or Finding Groups to Jira as one grouped issue or separate issues, with deep links and filter context preserved. • Attack Paths query selector now hides confirmed-empty queries for the selected scan, surfacing only paths that returned data; full catalog published on Prowler Hub. • OCI provider setup no longer requires a region — SDK handles region discovery automatically, simplifying onboarding. • New AI agents tutorials and overview banner guide users through connecting AI agents to Prowler Cloud via the API to query and act on security posture programmatically. • Compliance overview ingest now runs in a single transaction per scan with a configurable `DJANGO_COMPLIANCE_COPY_BATCH_SIZE` (default 2000), reducing database write pressure at scale. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.35.0

Fri, 17 Jul 2026 10:44:06 GMT

Prowler 5.35.0 adds Lighthouse AI side chat and actions, one-step AWS Org onboarding, scan exclusions, and a redesigned sidebar. • Adds Lighthouse AI side panel: open a context-aware AI chat from anywhere in the app without leaving the current page, with tabs to switch between finding details and the chat (Prowler Cloud/Private Cloud). • Enables Lighthouse AI to take actions: connect/remove providers, trigger and schedule scans, update scan settings, and manage mute rules via chat, gated by RBAC (Prowler Cloud/Private Cloud). • Adds one-step AWS Organizations onboarding: a single CloudFormation quick-create link deploys the management account role and a service-managed StackSet to every member account (Prowler Cloud/Private Cloud). • Adds `excluded_checks` and `excluded_services` fields to scan configurations, allowing entire checks or services to be skipped per provider for faster, lower-noise scans. • Introduces a redesigned sidebar with grouped sections for security, settings, and help, collapsible configuration entries, route-aware active states, and a responsive mobile overlay. • Renames core Prowler MCP tools from the `prowler_app_*` prefix to the shorter `prowler_*` namespace; legacy `prowler_app_*` names remain functional. • Enables dynamic providers to be renamed and deleted directly from the Providers table. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.34.0

Wed, 15 Jul 2026 15:24:13 GMT

Prowler 5.34.0 adds E2E Networks provider, 9 new security checks across AWS/Azure/Kubernetes/STACKIT, and cross-provider compliance rollup. • New provider: Scans E2E Networks with 27 checks covering compute nodes, networking, security groups, load balancers, block/file storage, and managed databases. • New AWS check `ec2_ami_account_block_public_access`: verifies AMI block public access is enabled at the account level per region. • New AWS check `datapipeline_pipeline_no_secrets_in_definition`: scans Data Pipeline object fields, parameter objects, and parameter values for hardcoded secrets using Kingfisher. • New AWS check `elbv2_listener_pqc_tls_enabled`: verifies ELBv2 HTTPS/TLS listeners use post-quantum TLS security policies (TLS 1.2+) to reduce harvest-now-decrypt-later exposure. • New AWS check `amplify_app_no_secrets_in_environment`: scans Amplify app and branch environment variables and build settings (buildSpec) for hardcoded secrets using Kingfisher. • New Azure check `app_function_ensure_http_is_redirected_to_https`: verifies that Function Apps enforce HTTPS-only traffic. • New Kubernetes check `core_minimize_hostpath_volume_mounts`: detects Pods that use `hostPath` volumes. • New Kubernetes check `core_readonly_root_filesystem_enabled`: verifies every container in each Pod explicitly sets `readOnlyRootFilesystem: true` in its security context. • New STACKIT check `iaas_server_public_ip_attached`: flags IaaS servers with a public IP address directly attached to a network interface. • New Cross-Provider Compliance view (Prowler Cloud/Private Cloud): rolls up the most recent scan of every compatible provider into a single compliance posture per framework (CIS Controls 8.1, CSA CCM 4.0, DORA 2022/2554) with per-provider breakdown and combined executive PDF export. • UI now lists, filters, and renders dynamically registered (custom) providers with a generic icon, humanized label, and 'Custom' badge when no bespoke assets exist. Breaking changes: • UI integration enable flags renamed: `UI_SENTRY_ENABLE` → `UI_SENTRY_ENABLED`, `UI_GOOGLE_TAG_MANAGER_ENABLE` → `UI_GOOGLE_TAG_MANAGER_ENABLED`, `UI_POSTHOG_ENABLE` → `UI_POSTHOG_ENABLED`; deployments that set the former names must update them. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.33.0

Tue, 07 Jul 2026 15:52:48 GMT

Prowler 5.33.0 adds agentic Lighthouse AI assistant, credential-free compliance PDFs, and scan queueing. • New Lighthouse AI agentic assistant (Prowler Cloud/Enterprise) queries findings, compliance posture, and risky resources using configurable LLM providers (OpenAI, Amazon Bedrock, or any OpenAI-compatible endpoint). • Persistent chat sessions with real-time streaming, session history, archiving, and a sidebar chat mode accessible from any page in the Prowler Cloud UI. • Compliance PDF reports now generate without active provider credentials, drawing on provider metadata stored in the database. • Overlapping scans for the same provider now queue behind the active scan instead of running concurrently, eliminating duplicate or racing scan workers. • Kubernetes provider rejects kubeconfigs using `exec` authentication in Prowler Cloud, blocking user-supplied commands from executing on Cloud workers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.32.0

Thu, 02 Jul 2026 13:09:04 GMT

Prowler 5.32.0 adds Kingfisher secret scanning, Azure resource-group scoping, Okta throttling, AWS resource caps, Neptune graph sink, and 6 new checks. • New secret-scanning engine: replaces detect-secrets with Kingfisher, runs fully offline, suppresses placeholder false positives, and adds `--scan-secrets-validate` / `aws.secrets_validate` for live credential verification (confirmed live secrets reported as critical). • Azure scans now support `--azure-resource-group` / `--azure-resource-groups` to scope assessments to one or more resource groups instead of the entire subscription. • Okta provider adds configurable API request throttling (`--okta-requests-per-second`, default 4 req/s) and retry cap (`--okta-retries-max-attempts`, default 5) to survive rate limits on large tenant scans. • AWS scans can now cap the number of resources analyzed per high-volume service via `max_scanned_resources_per_service` (global) or per-service limits: `max_ebs_snapshots`, `max_backup_recovery_points`, `max_cloudwatch_log_groups`, `max_lambda_functions`, `max_ecs_task_definitions`, `max_codeartifact_packages`. • Attack Paths gains AWS Neptune as a persistent graph sink alongside Neo4j, selectable via `ATTACK_PATHS_SINK_DATABASE=neptune`, enabling managed, larger-scale cross-provider graph storage. • New AWS check `stepfunctions_statemachine_encrypted_with_cmk`: flags Step Functions state machines not using a customer-managed KMS key. • New AWS check `waf_regional_webacl_logging_enabled`: flags AWS WAF Classic Regional Web ACLs without Kinesis Data Firehose logging. • New AWS check `apigateway_restapi_no_secrets_in_stage_variables`: scans API Gateway REST API stage variables for hardcoded passwords, API keys, and tokens. • New AWS check `s3_bucket_object_public`: spot-checks object ACLs for public grants (`AllUsers`/`AuthenticatedUsers`); opt in via `s3_bucket_object_public_enabled` config option. • `awslambda_function_no_secrets_in_code` adds `secrets_ignore_files` audit-config option to skip files by glob pattern (e.g. `*.deps.json`), suppressing .NET dependency-manifest false positives. • IAM privilege-escalation checks now cover AWS Bedrock AgentCore paths (Runtime, Harness, Code Interpreter, Custom Browser). • New Microsoft 365 Conditional Access checks: `entra_conditional_access_policy_explicitly_targets_azure_devops` and `entra_conditional_access_policy_no_exclusion_gaps`, plus Entra Conditional Access group management restriction check. • Compliance frameworks can now declare `ConfigRequirements` on a requirement, marking it FAIL when mapped checks ran under a configuration too permissive to satisfy it — reflected in CSV, OCSF, and console outputs. • New compliance frameworks added: CIS 7.0 for AWS, CIS 7.0 for M365, CIS 6.0 for Azure, CIS 5.0 for GCP, CIS Controls v8.1 universal framework, CIS 1.2 for GitHub, CIS 2.0.1 for Kubernetes. • GitHub branch-protection checks now evaluate repository rulesets in addition to branch protection rules. • API `/api/v1/findings` endpoint accepts full ISO 8601 timestamps on `filter[inserted_at__gte]`, `filter[inserted_at__lte]`, `filter[updated_at__gte]`, and `filter[updated_at__lte]` filters for precise time-window queries. • Prowler Cloud/Enterprise: Scan Configuration management page enables named, reusable YAML scan configs validated against a per-provider schema and attachable to one or more providers. • Prowler Cloud/Enterprise: Provider Group Filter scopes the Overview, Findings, Resources, Scans, and Providers views to a team or environment in a single click. Breaking changes: • The `detect_secrets_plugins` configuration option has been removed, as it is no longer used by the new secret-scanning engine (Kingfisher). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.31.0

Tue, 23 Jun 2026 14:02:04 GMT

Prowler 5.31.0 adds Linode provider, post-quantum crypto checks, DORA coverage for Azure/GCP/Cloudflare/Alibaba, and 40+ new checks across AWS, Azure, GCP, K8s, and M365. • New provider: Scans Linode (Akamai Cloud) covering administration, compute, and networking services. • Adds DORA (2022/2554) compliance framework mapping to Azure, GCP, Cloudflare, and Alibaba Cloud providers (use framework name `DORA_2022_2554`). • New AWS post-quantum cryptography readiness checks: `cloudfront_distributions_pqc_tls_enabled`, `apigateway_domain_name_pqc_tls_enabled`, `transfer_server_pqc_ssh_kex_enabled`, `acmpca_certificate_authority_pqc_key_algorithm` (new `acmpca` service), and `rolesanywhere_trust_anchor_pqc_pki` (new `rolesanywhere` service). • New AWS organization-wide governance checks: `securityhub_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions`. • New AWS ML check: `sagemaker_clarify_exists` verifies at least one SageMaker Clarify processing job exists per region for bias-detection and explainability controls. • New Azure checks spanning Cosmos DB (automatic failover, continuous backup, TLS 1.2, public access), MySQL/PostgreSQL Flexible Servers (geo-redundant backup, high availability), AKS (auto-upgrade, Container Insights, local accounts disabled, Defender), Databricks (public network access, secure cluster connectivity), Defender CSPM, Networking (NSG on subnets, DDoS protection on VNets), Entra ID (credential expiry, sign-in, strong auth), and Recovery Services vaults. • New GCP checks: `cloudsql_instance_high_availability_enabled`, `cloudfunction_function_inside_vpc`, `cloudfunction_function_not_publicly_accessible`, `secretmanager_secret_not_publicly_accessible`, and `secretmanager_secret_rotation_enabled`. • New Kubernetes checks for container resource governance: CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes. • New Microsoft 365 checks: `entra_directory_sync_object_takeover_blocked` and `entra_conditional_access_policy_no_deleted_object_references`. • New OCI check: `identity_storage_service_level_admins_scoped` (CIS 3.1 control 1.15) ensures storage admins exclude delete permissions. • Prowler SDK now supports Python 3.13. • Flexible per-provider scan scheduling in Prowler Cloud with daily, 48-hour, weekly, and monthly cadence options via the Providers page and a new Scheduled tab in Scan Jobs. • Guided onboarding experience in Prowler Cloud with contextual empty states and first-provider prompts. • SAML SSO `userType` attribute is now optional; missing or blank values preserve existing user roles rather than applying a fallback role. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.31.0

Tue, 23 Jun 2026 14:02:04 GMT

Prowler 5.31.0 adds Linode provider, post-quantum AWS checks, DORA coverage for Azure/GCP/Cloudflare/Alibaba, and 30+ new checks across AWS, Azure, GCP, K8s, and M365. • New `linode` provider: scans Linode (Akamai Cloud) administration, compute, and networking services via `prowler linode`. • New AWS post-quantum cryptography checks: `cloudfront_distributions_pqc_tls_enabled`, `apigateway_domain_name_pqc_tls_enabled`, `transfer_server_pqc_ssh_kex_enabled`, `acmpca_certificate_authority_pqc_key_algorithm` (new `acmpca` service), and `rolesanywhere_trust_anchor_pqc_pki` (new `rolesanywhere` service). • New AWS org-wide governance checks: `securityhub_delegated_admin_enabled_all_regions` and `config_delegated_admin_and_org_aggregator_all_regions`. • New AWS ML check: `sagemaker_clarify_exists` verifies at least one SageMaker Clarify processing job exists per region. • Extends DORA (EU 2022/2554) compliance framework coverage to Azure, GCP, Cloudflare, and Alibaba Cloud under the `DORA_2022_2554` framework identifier. • New Azure checks across Cosmos DB (automatic failover, continuous backup, TLS 1.2, public access disabled), MySQL/PostgreSQL Flexible Servers (geo-redundant backup, HA), AKS (auto-upgrade, Container Insights, local accounts disabled, Defender), Databricks (public access, secure connectivity), Defender CSPM Standard tier, NSG subnet association, DDoS VNet protection, Entra ID credential expiry and strong auth, and Recovery Services vaults. • New GCP checks: `cloudsql_instance_high_availability_enabled`, `cloudfunction_function_inside_vpc`, `cloudfunction_function_not_publicly_accessible`, `secretmanager_secret_not_publicly_accessible`, and `secretmanager_secret_rotation_enabled`. • New Kubernetes checks for CPU/memory limits and requests, fixed image tags, liveness probes, and readiness probes. • New M365 checks: `entra_directory_sync_object_takeover_blocked` and `entra_conditional_access_policy_no_deleted_object_references`. • New OCI check: `identity_storage_service_level_admins_scoped` (CIS 3.1 control 1.15) ensuring storage admins exclude delete permissions. • Prowler SDK now supports Python 3.13. • Optional SAML SSO `userType` attribute: when absent or blank, Prowler preserves existing user roles instead of applying a fallback role. • Prowler Cloud: flexible per-provider scan scheduling with Daily, Every 48 hours, Weekly, or Monthly cadences configurable from the Providers page. • Prowler Cloud: guided onboarding experience for new accounts with contextual empty states throughout the product. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.30.0

Thu, 11 Jun 2026 10:32:55 GMT

Prowler 5.30.0 adds complete Okta DISA STIG V1R2 coverage, the DORA universal compliance framework, and 10+ new checks across AWS, M365, GCP, and StackIT. • Adds complete DISA Okta IDaaS STIG V1R2 framework coverage with 18 new checks spanning user inactivity, password policy, MFA hardening, smart card, network zones, API tokens, and system log streaming. • Introduces DORA (Digital Operational Resilience Act) as Prowler's first universal compliance framework, mapping AWS checks across the five DORA pillars with OCSF Compliance Finding export support. • New AWS check `sagemaker_models_monitor_enabled` verifies each SageMaker monitoring schedule is in the `Scheduled` state to catch data and model drift. • New AWS check `elbv2_alb_drop_invalid_header_fields_enabled` verifies Application Load Balancers drop invalid HTTP header fields to mitigate HTTP desync attacks (FSBP ELB.4). • New AWS check `bedrock_agent_role_least_privilege` verifies Bedrock Agents run with least-privilege IAM roles. • New M365 check `entra_service_principal_privileged_role_no_owners` flags privileged service principals that have no assigned owners. • New M365 check `exchange_mailbox_primary_smtp_custom_domain` verifies mailbox primary SMTP addresses use a custom domain. • GCP `kms_key_rotation_enabled` is split into two focused checks: one for rotation being enabled and one enforcing a maximum 90-day rotation period. • New StackIT `objectstorage` service with three checks: Object Lock (WORM protection), retention policy enforcement, and access key expiration. • Adds support for external/custom providers, checks, and compliance frameworks without modifying Prowler core code. • Postgres connections are now labeled with `application_name=":"` (set via `DJANGO_APP_COMPONENT`) for per-component attribution in `pg_stat_activity`. • UI adds dedicated compliance detail pages and icons for DISA Okta IDaaS STIG V1R2 and DORA frameworks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.30.0

Thu, 11 Jun 2026 10:32:55 GMT

Prowler 5.30 adds full Okta DISA STIG coverage, a universal DORA compliance framework, 8 new checks across AWS/M365/GCP/StackIT, and self-healing background task recovery. • Adds complete DISA Okta IDaaS STIG V1R2 framework coverage for the Okta provider, spanning six new services: `user`, `authenticator`, `idp`, `network`, `apitoken`, and `systemlog` with 17 new checks covering account inactivity, MFA hardening, password policy, smart card, API token privilege, network zone enforcement, and log streaming. • Introduces DORA (Digital Operational Resilience Act) as Prowler's first universal compliance framework — defined once and mapped across providers — currently covering AWS checks across the five DORA pillars and exportable in OCSF Compliance Finding format for SIEM ingestion. • New AWS check `sagemaker_models_monitor_enabled` verifies each SageMaker monitoring schedule is in the `Scheduled` state to detect data and model drift. • New AWS check `elbv2_alb_drop_invalid_header_fields_enabled` verifies Application Load Balancers drop invalid HTTP header fields to mitigate HTTP desync attacks (AWS FSBP ELB.4). • New AWS check `bedrock_agent_role_least_privilege` verifies Bedrock Agents run with a least-privilege IAM role. • New M365 check `entra_service_principal_privileged_role_no_owners` flags privileged service principals with no assigned owners. • New M365 check `exchange_mailbox_primary_smtp_custom_domain` verifies mailbox primary SMTP addresses use a custom domain. • Splits GCP `kms_key_rotation_enabled` into two focused checks: one for rotation being enabled and one enforcing a maximum 90-day rotation period. • New StackIT `objectstorage` service adds three checks: `objectstorage_bucket_object_lock_enabled` (WORM protection), `objectstorage_bucket_retention_policy` (default retention enforcement), and `objectstorage_access_key_expiration` (credential expiry). • Adds support for external/custom providers, checks, and compliance frameworks without modifying core Prowler code, including discovery of external universal compliance frameworks via entry points. • Enables opt-in self-healing background task recovery via `DJANGO_TASK_RECOVERY_ENABLED`; safe-to-retry tasks (report summaries, cleanups) auto-resume after worker crashes while scan tasks are never blindly re-run. • Adds `reconcile_orphan_tasks` Django management command for on-demand recovery of orphaned background tasks. • Labels Postgres connections with `application_name=":"` (configurable via `DJANGO_APP_COMPONENT`) for per-component attributability in `pg_stat_activity`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.29.2

Wed, 03 Jun 2026 16:04:49 GMT

Prowler 5.29.2 adds provider icons to account/provider-type selector triggers in the UI. • Account and provider-type selector triggers now display the provider icon with a non-deduped icon stack for easier visual identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.29.0

Mon, 01 Jun 2026 15:21:21 GMT

Prowler 5.29.0 adds StackIT provider, 26 new Google Workspace & Okta checks, AWS AI Security Framework compliance, and a redesigned Scan Jobs UI. • Adds StackIT (German sovereign cloud) as a new provider, authenticating via service account key file (`--stackit-service-account-key-path`) or inline JSON (`--stackit-service-account-key`) for CI/CD pipelines. • Adds 20 new Google Workspace checks (8 Rules service, 12 Security service) via the Cloud Identity Policy API, completing automated coverage of the CIS Google Workspace Benchmark 1.3. • Adds new `application` service for the Okta provider with 6 checks covering admin console and dashboard hardening (MFA, phishing-resistant auth, session idle timeout, network zone enforcement). • Adds `storage_account_public_network_access_disabled` check for Azure that flags storage accounts allowing public network access. • Adds AWS AI Security Framework compliance mapping, linking Prowler checks to AWS AI/ML security guidance. • Speeds up `GET /api/v1/finding-groups/latest` aggregation on tenants where one recent scan holds most findings. • Redesigns the Scan Jobs UI view with dedicated In Progress, Completed, and Scheduled tabs and a new scan-launch modal for picking accounts and adding scan notes. • Reworks dark mode with a pure-black canvas, pure-white primary text, and brighter border/input tokens for improved legibility. • Supports Azure authentication against sovereign clouds (`AzureChinaCloud`, `AzureUSGovernment`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.28.0

Fri, 22 May 2026 10:58:59 GMT

Prowler 5.28.0 adds Okta App scanning, 4 DISA STIG Okta checks, Google Workspace services/groups checks, new AWS/GCP/M365 checks, and a Claude Code plugin. • Adds Okta provider support in Prowler App with OAuth 2.0 private-key JWT credentials, enabling read-only scanning of Okta tenants from the UI. • Adds four new medium-severity Okta DISA STIG V1R2 checks: `signon_global_session_lifetime_18h`, `signon_global_session_cookies_not_persistent`, `signon_global_session_policy_network_zone_enforced`, and `signon_dod_warning_banner_configured`. • Adds four new Google Workspace services with six new checks — Sites (`sites_service_disabled`), Additional Services (`additionalservices_external_groups_disabled`), Marketplace (`marketplace_apps_access_restricted`), and Groups (`groups_creation_restricted`, `groups_external_access_restricted`, `groups_view_conversations_restricted`) — via the Cloud Identity Policy API. • Adds new AWS check `ses_identity_dkim_enabled` to verify DKIM signing is enabled on every SES identity. • Adds new AWS check `sagemaker_models_registry_in_use` to verify ML governance through the SageMaker Model Registry. • Adds new M365 check `entra_app_registration_client_secret_unused` to flag dormant Entra ID app registration client secrets. • Adds new GCP check `cloudsql_instance_cmek_encryption_enabled` to verify Cloud SQL instances use customer-managed encryption keys. • New 'Resource Metadata / Evidence' tab in the Prowler App finding detail drawer surfaces raw resource attributes captured at scan time, backed by the new `resource.metadata` attribute on `/api/v1/findings?include=resources`. • Ships a Claude Code plugin and marketplace entry (`prowler-cloud/prowler`) enabling Claude to drive end-to-end cloud security and compliance assessments via the Prowler MCP server. Breaking changes: • `okta.brands.read` is now part of `DEFAULT_SCOPES` for the Okta provider; existing Okta service apps must grant this scope before upgrading or the `signon_dod_warning_banner_configured` check will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.27.0

Tue, 19 May 2026 12:16:22 GMT

Prowler 5.27.0 adds Okta and Scaleway providers, 10 new checks across AWS/M365/GWS, a redesigned Attack Paths graph, and Lighthouse AI Finding Groups support. • New Okta provider (CLI-only): authenticate via OAuth read-only credentials and audit your Okta tenant; ships with `signon_global_session_idle_timeout_15min` mapped to DISA STIG V-273186. • New Scaleway provider (unofficial, CLI-only): audit Scaleway IAM with `iam_api_keys_no_root_owned` to flag root-owned API keys. • Google Workspace gains a Chat service with 6 CIS-mapped checks covering app installation, external file sharing, external messaging, external spaces, incoming webhooks, and internal file sharing. • New AWS check `cloudtrail_bedrock_logging_enabled` verifies at least one CloudTrail trail records Amazon Bedrock API activity. • New AWS check `iam_user_access_not_stale_to_sagemaker` flags IAM users with SageMaker access exceeding 90 days (tunable via `max_unused_sagemaker_access_days`) or who have never accessed SageMaker. • New AWS check `sagemaker_domain_sso_configured` verifies SageMaker Domains use IAM Identity Center (SSO) instead of IAM users. • New M365 check `entra_service_principal_no_secrets_for_permanent_tier0_roles` flags service principals holding credentials for permanent Tier-0 role assignments. • AWS IAM customer-managed policy checks now scan only attached policies by default; opt in to auditing unattached policies with `--scan-unused-services`. • Attack Paths graph in the Prowler App rewritten on React Flow with improved layout, pan/zoom, image export, and a minimap. • AWS findings and resource details in the Prowler App now include a one-click 'View in AWS Console' link via the `/go/view` ARN resolver. • Lighthouse AI can now list, filter, and inspect Finding Groups via new Finding Groups MCP tools. • PDF Compliance Reports now include only failed findings and cap per-check detail tables at 100 failed findings with a banner pointing to CSV/JSON exports. • Health endpoint added at `GET /api/health` for Docker Compose liveness checks. • Prowler API and SDK migrated from `poetry` to `uv` for faster, deterministic dependency installs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.26.0

Mon, 11 May 2026 13:04:08 GMT

Prowler 5.26.0 adds Gmail spoofing/attachment checks, AWS Bedrock hardening, ASD Essential Eight compliance, and a rebuilt finding triage drawer. • Adds eight new Google Workspace Gmail checks covering attachment safety (`gmail_anomalous_attachment_protection_enabled`, `gmail_encrypted_attachment_protection_enabled`, `gmail_script_attachment_protection_enabled`) and spoofing protection (`gmail_domain_spoofing_protection_enabled`, `gmail_employee_name_spoofing_protection_enabled`, `gmail_groups_spoofing_protection_enabled`, `gmail_inbound_domain_spoofing_protection_enabled`, `gmail_unauthenticated_email_protection_enabled`) via the Cloud Identity Policy API. • Adds three new AWS Bedrock checks: `bedrock_guardrails_configured` (flags deployments without Guardrails), `bedrock_prompt_management_exists` (verifies Prompt Management is in use), and `bedrock_prompt_encrypted_with_cmk` (verifies CMK encryption per prompt). • Adds ASD Essential Eight Maturity Model (Maturity Level One, Nov 2023) as a first-class compliance framework for AWS, with full detail view, top-failed-sections breakdown, and export support. • Adds Prowler Cloud Alerts: auto-provisioned daily digest of critical findings for organization owners, plus custom alert rules scoped by provider, account, severity, or status, with a 'Create Alert' shortcut that converts active Findings page filters into a watching alert rule. • Adds 'Manage Alerts' RBAC permission to gate alert configuration to authorized organization admins. • Rebuilt finding detail drawer for triage: color-coded status banner at top, dedicated Remediation tab, one-click link to resource page, and immediate status render during carousel navigation. • Adds clickable ThreatScore pillars on `/compliance` that jump to the detail page with the selected accordion pre-expanded and scrolled into view. • Adds `scan-reset-ephemeral-resources` post-scan API task that zeroes `failed_findings_count` for resources absent from the latest full-scope scan, preventing ephemeral resources from polluting the Resources page sort. • Container image CVE findings and IaC findings now link remediation references directly to CVE.org, Prowler Hub, and GitHub Security Advisories; Trivy-sourced findings also link correctly into Prowler Hub. • Adds OCSF support for universal compliance output in the SDK. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.25.0

Tue, 28 Apr 2026 09:49:47 GMT

Prowler 5.25 adds a GitHub Action, zizmor-powered CI/CD workflow scanning, IaC SARIF output, Gmail checks, and more. • New official GitHub Action `prowler-cloud/prowler@5.25` runs Prowler scans in CI, with optional SARIF upload to GitHub Code Scanning and push to Prowler Cloud. • New GitHub Actions service uses zizmor v1.24.1 to statically scan `.github/workflows/*.yml` for OWASP Top 10 CI/CD risks including script injection, overly permissive `GITHUB_TOKEN`, untrusted checkouts, and dangerous triggers. • IaC provider now emits SARIF via `--output-formats sarif`, enabling IaC misconfigurations to appear as annotations in GitHub Security → Code Scanning on PRs. • New `--repo-list-file` CLI flag for the GitHub provider loads repositories from a file instead of enumerating them inline. • New Google Workspace Gmail service with 9 CIS-aligned checks covering mail delegation, link scanning, POP/IMAP access, auto-forwarding, and more. • New AWS check `secretsmanager_has_restrictive_resource_policy` evaluates resource-based policies on Secrets Manager secrets. • New GitHub check `repository_default_branch_dismisses_stale_reviews` flags repos whose default branch protection does not dismiss stale PR approvals on new commits (CIS 1.1.4). • CIS Benchmark PDF reports are now downloadable via `GET /scans/{id}/cis/{name}/` for the latest CIS variant per provider. • Tenant owners can now expel users from their organizations via the UI or `DELETE /tenants/{tenant_pk}/memberships/{id}`, immediately blacklisting outstanding refresh tokens. • Redesigned compliance page with client-side framework search, compact scan selector, and enhanced compliance cards. • Resources page gains batch-applied filters, syntax-highlighted metadata JSON, and a View Resource button from finding detail drawers. • Mutelist table adds name and reason search plus visual count badges on finding targets. • Imported OCSF scans in Prowler Cloud now generate the same downloadable report artifacts as CLI scans. • Overview endpoints (`/overviews/resource-groups`, `/overviews/categories`, `/overviews/attack-surfaces`) now reflect newly muted findings immediately without waiting for the next scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.24.4

Fri, 24 Apr 2026 11:18:07 GMT

Prowler 5.24.4 adds Sentry performance tracing for the API and makes the Neo4j connection acquisition timeout configurable. • New `DJANGO_SENTRY_TRACES_SAMPLE_RATE` env var enables Sentry performance tracing for the Prowler API (default 0.02). • Neo4j `connection_acquisition_timeout` for Attack Paths is now configurable via the `NEO4J_CONN_ACQUISITION_TIMEOUT` env var. Breaking changes: • The Neo4j `connection_acquisition_timeout` default is lowered from 120 s to 15 s; environments relying on slow Neo4j connections may see acquisition timeouts that previously succeeded. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.24.3

Wed, 22 Apr 2026 14:30:30 GMT

Prowler 5.24.3: muted findings now instantly reflected in overview endpoints without waiting for the next scan. • Overview endpoints `/overviews/findings`, `/overviews/findings-severity`, and `/overviews/services` now reflect newly-muted findings immediately after muting, without waiting for the next scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.24.0

Wed, 15 Apr 2026 17:31:13 GMT

Prowler 5.24.0 adds 13 new AWS/M365 checks, region exclusion filtering, and a redesigned resource detail drawer. • New `bedrock_full_access_policy_attached` check flags IAM principals with `AmazonBedrockFullAccess` or wildcard Bedrock permissions. • New `iam_role_access_not_stale_to_bedrock` and `iam_user_access_not_stale_to_bedrock` checks detect dormant GenAI access that hasn't been used recently. • New `bedrock_vpc_endpoints_configured` check verifies Bedrock traffic stays on private VPC endpoints instead of the public internet. • New `iam_policy_no_wildcard_marketplace_subscribe` and `iam_inline_policy_no_wildcard_marketplace_subscribe` checks catch wildcard `aws-marketplace:Subscribe` grants that could turn an IAM misconfiguration into a billing incident. • New `entra_conditional_access_policy_all_apps_all_users` check ensures at least one Conditional Access policy targets every app and every user. • New `entra_conditional_access_policy_mfa_enforced_for_guest_users` check verifies MFA is enforced for guest and external users. • New `entra_conditional_access_policy_block_unknown_device_platforms` check flags CA policies that allow access from unknown device platforms. • New `entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced` check ensures sign-in frequency is enforced for non-corporate devices. • New `entra_conditional_access_policy_directory_sync_account_excluded` check validates that the directory sync account is excluded from restrictive CA policies. • New `intune_device_compliance_policy_unassigned_devices_not_compliant_by_default` check flags tenants where unassigned devices are marked compliant by default. • New `exchange_organization_delicensing_resiliency_enabled` check verifies mailbox data remains accessible for 30 days after license removal. • Adds `--excluded-region` CLI flag, `PROWLER_AWS_DISALLOWED_REGIONS` environment variable, and `aws.disallowed_regions` config key to exclude specific AWS regions from scans. • Redesigned resource detail side drawer consolidates metadata, findings, and event timeline in a single panel for in-context investigation. • Syntax highlighting for remediation code blocks in the finding groups drawer with provider-aware auto-detection of Shell, HCL, YAML, and Bicep. • Attack Paths 'View Finding' now opens the finding drawer inline over the graph, preserving graph zoom, selection, and filter state. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.23.0

Mon, 13 Apr 2026 15:56:23 GMT

Prowler 5.23.0 adds Vercel provider (26 checks), grouped findings view, MCP resource events timeline, 25+ new checks across AWS/GCP/M365/Google Workspace, and new CLI resource-group flags. • New Vercel provider: connect via API token to audit deployments, domains, projects, and team settings with 26 built-in security checks. • Findings Grouped View in the UI collapses repeated misconfigurations into one row per check with an X-of-Y impacted resources counter, inline resource expansion, bulk-mute, and an 'Other Findings For This Resource' tab in the detail drawer. • MCP Server gains a resource events tool that returns a who/what/when CloudTrail timeline (actor, event name, source IP, user agent, request/response payloads) for any AWS resource, queryable from any MCP client. • New `--resource-group` and `--list-resource-groups` CLI flags to filter checks by resource group across all providers. • Attack Paths custom query editor now includes syntax highlighting and line numbering for openCypher queries. • New Google Workspace compliance frameworks: CISA SCuBA Baselines and CIS Foundations Benchmark v1.3.0. • OCI multi-region filtering via `--region` now covers filestorage, blockstorage, kms, compute, and identity services including regions outside the tenancy home region. • OCI Mutelist support now passes tenancy_id to is_finding_muted. • New AWS check `glue_etl_jobs_no_secrets_in_arguments` detects plaintext secrets in Glue ETL job arguments. • New AWS checks `awslambda_function_no_dead_letter_queue`, `awslambda_function_using_cross_account_layers`, and `awslambda_function_env_vars_not_encrypted_with_cmk`. • New AWS check `stepfunctions_statemachine_no_secrets_in_definition` detects secrets in Step Functions state machine definitions. • New AWS check `ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip` using ipaddress.is_global for accurate public IP detection. • Updated AWS check `cloudfront_distributions_logging_enabled` now detects Standard Logging v2 via CloudWatch Log Delivery. • Two new GCP checks for Gemini API coverage: `apikeys_api_restricted_with_gemini_api` and `gemini_api_disabled`. • 15 new Google Workspace checks spanning directory, calendar, drive, and docs services. • Four new Microsoft 365 Conditional Access Policy checks for Entra ID aligned with Microsoft security baselines. • `--list-checks` and `--list-checks-json` now include the `threat-detection` category. • Sensitive CLI flag values (tokens, keys, passwords) are now redacted in HTML output 'Parameters used' field. • Harden-Runner enabled across GitHub Actions workflows to monitor and restrict outbound network traffic during CI runs. • New `VALKEY_SCHEME`, `VALKEY_USERNAME`, and `VALKEY_PASSWORD` environment variables to configure Celery broker TLS/auth for Valkey/ElastiCache. Breaking changes: • Minimum Python version is now 3.10; installations running Python 3.9 will no longer work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.22.0

Tue, 24 Mar 2026 12:18:55 GMT

Prowler 5.22.0 adds Attack Paths custom openCypher queries, batch filter apply in Findings, and check_title substring filtering in the API. • Adds custom openCypher query support in Attack Paths, with Cartography schema guidance and Lighthouse AI assistance for query generation. • New batch-apply filter pattern on the Findings page — configure multiple filters before executing, eliminating per-selection API calls and layout shifts. • Finding groups API now supports `check_title` substring filtering. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.21.0

Thu, 19 Mar 2026 11:59:30 GMT

Prowler 5.21.0 adds Google Workspace and Container Image UI support, AWS CloudTrail timeline, Lighthouse AI query skills, and new M365/GitHub checks. • Adds Google Workspace provider full support in the Prowler App UI — connect and scan Google Workspace environments directly from the interface. • Adds Container Image (container registry) provider support in the Prowler App UI, including badge icon, credentials form, and provider-type filtering. • Adds AWS Resource Timeline: a new Events tab in Findings and Resource detail cards shows the last 90 days of AWS CloudTrail events with expandable event rows, actor details, request/response JSON payloads, error info, and a read-event toggle. • Adds Lighthouse AI skill system with a new Attack Path Custom Query skill that supplies the LLM with `openCypher` syntax guidance and Cartography schema knowledge for writing graph queries. • Adds a new MCP tool to retrieve the Cartography Neo4j DB scan schema for use in Attack Path queries. • Adds `entra_conditional_access_policy_device_code_flow_blocked` check for M365/Entra: detects whether Conditional Access policy blocks device code flow to prevent phishing attacks. • Adds `entra_conditional_access_policy_require_mfa_for_admin_portals` check for M365/Entra: detects whether Conditional Access policy requires MFA for Microsoft Admin Portals. • Adds `organization_repository_deletion_limited` check for GitHub: verifies that organization repository deletion and transfer is restricted to owners. • Adds SecNumCloud 3.2 compliance framework coverage for AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud. • Adds Reserve Bank of India (RBI) compliance framework for the Azure provider. • Adds `misconfig` scanner as the default scanner for Image provider scans. • Enables `CORS_ALLOWED_ORIGINS` to be configured via environment variable in the API. • Adds tenant and provider-related labels to Attack Path graph nodes to enable easier filtering in custom queries. • Adds AWS Organizations UI management improvements: edit organization names and credentials, run connection tests scoped to all accounts or a specific organizational unit, and delete individual organizational units or full organizations. • Adds OCI region support for US DoD regions. Breaking changes: • Attack Paths completes migration to private graph labels and properties, removing deprecated dual-write support — existing integrations relying on the deprecated graph labels or properties will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.20.0

Thu, 12 Mar 2026 16:41:31 GMT

Prowler 5.20.0 adds Google Workspace API support, OpenStack object storage checks, new AWS/M365 detections, and a community Helm chart. • Adds Google Workspace scanning via the Prowler API (previously CLI-only since v5.19.0), enabling programmatic provider connection and scan triggering. • Adds 7 new OpenStack Object Storage security checks covering container access control, versioning, encryption, metadata hygiene, and lifecycle management. • New AWS check `guardduty_delegated_admin_enabled_all_regions` verifies a delegated administrator is configured for GuardDuty across all regions. • New `trusted_ips` configuration option for `opensearch_service_domains_not_publicly_accessible` eliminates false positives when an OpenSearch domain restricts access to known IPs via resource policy. • New M365 check `entra_conditional_access_policy_approved_client_app_required_for_mobile` enforces approved client apps on mobile devices. • New M365 check `entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required` enforces compliant/hybrid-joined device or MFA. • AWS Organizations findings now include Organizational Unit ID and name across ASFF, OCSF, and CSV output formats. • Attack Paths network exposure queries migrated from APOC to standard openCypher, enabling compatibility with Neo4j and Neptune. • Official community-maintained Helm chart published as an OCI artifact to `oci://ghcr.io/prowler-cloud/charts/prowler` for self-hosted Kubernetes deployments. • `POST /api/v1/providers` now returns `409 Conflict` when a provider already exists. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.19.0

Wed, 04 Mar 2026 11:40:45 GMT

Prowler 5.19.0 adds container image scanning, Google Workspace & OpenStack multi-region support, 40+ new checks, and Attack Paths upgrades. • New `--push-to-cloud` CLI flag uploads findings in OCSF format directly to Prowler Cloud for centralized visibility. • New `POST /api/v1/ingestions` API endpoint enables CI/CD pipelines to import scan findings into Prowler Cloud. • New Image provider (powered by Trivy) enables container image vulnerability scanning by tag, digest, or full registry enumeration across OCI registries, Docker Hub, and Amazon ECR. • New Google Workspace provider brings organizational security visibility starting with the Directory service. • OpenStack provider now supports multiple regions from a single provider configuration. • Adds 26 new OpenStack security checks across Compute, Networking, Block Storage, and Image services. • Adds 12 new Microsoft 365 security checks covering Entra ID, Defender for Identity, Defender XDR, and email protection. • Adds enhanced AWS IAM privilege escalation detection checks using patterns from the pathfinding.cloud library. • Adds `organization_verified_badge` check for the GitHub provider. • Cloudflare provider now has full Prowler App (UI) support with 29 security checks covering TLS/SSL, DNS, email security, WAF, bot protection, and zone configuration. • AWS Organizations onboarding in Prowler Cloud allows connecting multiple AWS accounts from an Organization hierarchy in a single flow. • Attack Paths feature gains the full query library from pathfinding.cloud, covering privilege escalation and lateral movement detection. • Attack Paths queries now include detailed descriptions and source links to pathfinding.cloud. • Prowler MCP Server now includes Attack Paths tools, enabling AI agents to query privilege escalation and lateral movement paths. • Adds CSA CCM 4.0 compliance framework across AWS, Azure, GCP, Oracle Cloud, and Alibaba Cloud. • Adds CIS Amazon Web Services Foundations Benchmark v6.0 compliance framework. • Adds ANSSI SecNumCloud compliance framework for AWS. • Unified provider connection wizard redesigned as a modal with a consistent experience across all provider types. • OpenStack providers can now be managed from the Prowler App UI. • Respects `AWS_ENDPOINT_URL` environment variable for STS session creation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.18.0

Thu, 05 Feb 2026 14:19:54 GMT

Prowler 5.18.0 adds OpenStack provider support, CodeBreach detection, HIPAA for Azure, and new checks across AWS, M365, and GCP. • Adds OpenStack as a new cloud provider (CLI only) with initial Compute service coverage and first security check, enabling private cloud assessments. • New check `codebuild_project_webhook_filters_use_anchored_patterns` detects the CodeBreach vulnerability in AWS CodeBuild projects by verifying webhook filter anchor patterns. • New AWS check `rds_instance_extended_support` detects RDS instances using extended support. • New M365 checks: `defender_zap_for_teams_enabled` and `exchange_shared_mailbox_sign_in_disabled`. • New GCP check `compute_instance_suspended_without_persistent_disks` for suspended instances lacking persistent disks. • Adds HIPAA compliance framework for the Azure provider. • New `--account-id` filter argument for Cloudflare CLI scans. • Cloudflare provider credentials now accepted as constructor parameters (`api_token`, `api_key`, `api_email`) for SDK usage. • AWS cross-account checks are now configurable via the `trusted_account_ids` config parameter. • New attack path privilege escalation queries covering Bedrock Code Interpreter and `AttachRolePolicy` patterns. • Cartography upgraded to 0.126.1, expanding AWS attack path scans to include SageMaker, CloudFront, and Bedrock. • Neo4j database per-tenant architecture for Attack Paths improves isolation and performance. • New `GET /api/v1/resources/{id}/events` API endpoint retrieves AWS resource modification history from CloudTrail. • New `provider_id` and `provider_id__in` filters added to `GET /resources` and `GET /resources/metadata/latest` API endpoints. • Redesigned Resources view with an improved resource detail drawer in the UI. • Launch Scan page now displays all providers without pagination limits. • Azure Key Vault vaults and vault contents retrieval now runs in parallel for faster scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.17.0

Thu, 22 Jan 2026 09:31:44 GMT

Prowler 5.17.0 adds Attack Paths visualization, Cloudflare provider, AWS EUSC support, 10 new GCP checks, and three new CIS compliance frameworks. • New Attack Paths feature powered by Cartography and Neo4j lets security teams execute graph-based queries, visualize attack vectors, and identify privilege escalation and lateral movement paths across AWS environments. • New Cloudflare provider (CLI) enables scanning of Cloudflare infrastructure for misconfigurations across zones, DNS, email security (SPF, DKIM, DMARC), WAF, bot protection, and TLS/SSL configuration. • Full Alibaba Cloud provider support in the Prowler App and API, including UI-based provider management, security scanning, findings views, and ThreatScore calculation. • Adds support for AWS European Sovereign Cloud regions, enabling data-residency-constrained organizations to run Prowler security scans. • New Resource Groups Overview aggregates cloud resources by security-relevant categories (Compute, Storage, Network, Identity) with finding severity breakdowns via new `/api/v1/overviews/resource-groups` endpoint. • New Compliance Watchlist component on the Overview page and `/api/v1/overviews/compliance-watchlist` API endpoint for monitoring critical compliance frameworks at a glance. • ThreatScore pillar breakdown added to the Compliance Summary page, showing per-pillar (Identity, Data Protection, Network Security, etc.) contribution to overall risk score. • Adds `/api/v1/attack-paths-scans` API endpoint for AWS providers backed by Neo4j to programmatically trigger and query Attack Paths scans. • New `group` filter on `GET /findings` and `GET /findings/metadata/latest` endpoints for resource-group-based finding queries. • Adds CIS Azure Foundations Benchmark v5.0, CIS Microsoft 365 Benchmark v6.0, and CIS Kubernetes Benchmark v1.12 compliance frameworks. • Adds 10 new GCP Compute checks: `compute_instance_group_multiple_zones`, `compute_instance_group_autohealing_enabled`, `compute_instance_group_load_balancer_attached`, `compute_instance_disk_auto_delete_disabled`, `compute_configuration_changes`, `compute_instance_single_network_interface`, `compute_image_not_publicly_shared`, `compute_snapshot_not_outdated`, `compute_project_os_login_2fa_enabled`, and `compute_instance_on_host_maintenance_migrate`. • AI Skills Pack added for Claude Code, OpenCode, and Codex following the agentskills.io standard to help AI coding assistants understand and contribute to Prowler's codebase. • Redesigned findings table with improved multi-select filtering UX, enhanced table interactions, and resource group filter integration. • Provider and resource group label filters added to the Resources page in the UI. • Search bar added when adding a new provider in the UI. Breaking changes: • Azure service principals used to scan Azure must now be granted the `AuditLog.Read.All` Microsoft Graph permission due to an additional API call required for the Azure Entra performance enhancement. • Resource group data will only populate from scans executed after upgrading to v5.17.0; previous scan data will not include resource group information. • The `resource_group` filter parameter is renamed to `group` in the Resources page and Overview cards API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.16.0

Thu, 18 Dec 2025 16:36:30 GMT

Prowler 5.16.0 adds MCP Server-powered Lighthouse AI, Simple Mutelist, category filtering on findings endpoints, and two new AWS check categories. • Integrates Prowler's official MCP Server with Lighthouse AI for standardized, faster AI-driven security interactions. • Adds new MCP tools for Compliance Framework Management, enabling AI assistants to query compliance status and drill down to requirement-level details. • Introduces Simple Mutelist: mute findings directly from the findings table and manage mute rules via a new `/mutelist` page with Simple and Advanced (YAML) tabs. • New category overview endpoint provides severity breakdowns by security domain across your environment. • Adds `category` filter support to `GET /findings` and `GET /findings/latest` endpoints for scoped security domain analysis. • PDF reports now include Account ID, Alias, and Provider Name directly in the reporting table. • Adds two new AWS check categories: `privilege-escalation` and `ec2-imdsv1`, improving visibility into high-risk misconfigurations. • Adds Risk Radar component with category-based severity breakdown to the Overview page in the UI. • Adds SSO and API Key link cards to the Integrations page for better discoverability. • Exposes richer resource details (partition, details, and metadata) in Findings detail and Resources detail views. • Adds IaC supported formats and scanner documentation for the IaC provider. Breaking changes: • The `GET /overviews/attack-surfaces` endpoint no longer returns related check IDs in its response; consumers that depend on that field will receive an incomplete payload. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.15.0

Thu, 11 Dec 2025 14:36:14 GMT

Prowler 5.15.0 adds Alibaba Cloud support, a redesigned MCP Server, 5 new checks, and a richer Overview dashboard with Attack Surface, Threat Map, and Risk Pipeline panels. • Adds Alibaba Cloud as a new CLI provider with 63 available checks and CIS 2.0 benchmark support. • Adds MongoDB Atlas provider support in the Prowler App for assessing managed database cluster security posture. • Redesigns the MCP Server with comprehensive tools for Findings, Provider Management, Resource Management, Muting Management, and Scan Management — enabling AI-driven security workflows. • New Overview dashboard panels: Attack Surface (internet-facing resources, leaked secrets, privilege-escalation paths), Service Watchlist, Findings Severity Over Time, Risk Pipeline (Sankey chart), Threat Map (region-based pass/fail ratios), and Risk Plot (severity-weighted Threat Score visualization). • New API endpoint `GET /api/v1/overviews/findings_severity/timeseries` for daily aggregated findings by severity level. • New API endpoint to retrieve an overview of attack surfaces. • Lighthouse AI now supports Amazon Bedrock API key authentication as an alternative to IAM access keys. • New GCP check `cloudstorage_uses_vpc_service_controls` detects Cloud Storage buckets not protected by VPC Service Controls. • New GCP check `compute_instance_preemptible_vm_disabled` detects compute instances configured as preemptible VMs. • New GCP check `compute_instance_automatic_restart_enabled` verifies automatic restart is enabled on compute instances. • New GCP check `compute_instance_deletion_protection_enabled` verifies deletion protection is enabled on compute instances. • New GitHub check `repository_immutable_releases_enabled` detects repositories without immutable releases enforced. • Adds Processing Integrity requirements to the SOC 2 compliance framework for AWS, Azure, and GCP providers. • Adds RBI Cyber Security Framework compliance support for the Azure provider. • Adds CIS Alibaba Cloud Foundation Benchmark v2.0.0 compliance framework. • Introduces a navigation loading bar in the UI for visual feedback during page transitions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.14.0

Tue, 25 Nov 2025 15:16:38 GMT

Prowler 5.14 adds OCI and IaC providers, multi-LLM Lighthouse AI, MongoDB Atlas, 8 new checks, and ARM Docker images. • Adds Oracle Cloud Infrastructure (OCI) as a cloud provider with 51 checks and CIS OCI Foundations Benchmark v3.0.0 support. • Adds a new Infrastructure-as-Code (IaC) provider powered by Trivy for scanning Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts, Azure ARM templates, and secrets before deployment. • Adds MongoDB Atlas as a new provider (API only) with 10 available checks. • Expands Lighthouse AI with multi-LLM support: OpenAI, Amazon Bedrock (Claude, Llama, Titan), and OpenAI-compatible APIs such as OpenRouter. • Adds new compliance frameworks: C5 for Azure and GCP, HIPAA for GCP, NIST CSF 2.0 for AWS, CIS 3.0 for OCI, and FedRAMP 20x KSI Low for AWS, Azure, and GCP. • Adds PDF reporting for ENS, NIS2, and Prowler ThreatScore compliance frameworks. • Adds ThreatScore for the Kubernetes provider. • Adds `metadata`, `details`, and `partition` attributes to the `/resources` endpoint, and `details` and `partition` to the `/findings` endpoint for raw cloud provider API transparency. • Adds new endpoint `GET /api/v1/overview/regions` to retrieve aggregated findings data by region. • Adds muting of findings based on simple rules with a custom reason via the API. • Adds new AWS check `codepipeline_project_repo_private`. • Adds five new GCP Cloud Storage checks: `cloudstorage_bucket_versioning_enabled`, `cloudstorage_bucket_soft_delete_enabled`, `cloudstorage_bucket_logging_enabled`, `cloudstorage_audit_logs_enabled`, and `cloudstorage_bucket_sufficient_retention_period`. • Adds new Azure PostgreSQL Flexible Server check `postgresql_flexible_server_entra_id_authentication_enabled`. • Adds new GitHub check `organization_default_repository_permission_strict`. • Publishes multi-architecture Docker images (`linux/amd64` and `linux/arm64`) to Docker Hub. • Adds RSS feed for real-time release announcements and incident notifications in the Latest Updates panel. • Adds redesigned Overview dashboard featuring Prowler ThreatScore, severity distribution visualization, and faster access to latest failed findings. • Adds provider-type filters and optional pagination disable to `GET /api/v1/providers`. • Adds new endpoint to retrieve the number of providers grouped by provider type. • Extends `GET /api/v1/overviews/services` to make date filters optional, returning latest scan data by default. • Delivers major scan performance improvements: batch inserts replacing per-finding transactions, aggregated compliance lookup table reducing average response times from ~0.9s to ~20ms. • Adds external resource links to IaC findings for direct navigation to source code in Git repositories. • Uses branch name as the region identifier for IaC findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.13.0

Fri, 24 Oct 2025 08:45:37 GMT

Prowler 5.13.0 adds OCI and LLM providers, MCP Server, API key auth, PDF ThreatScore reports, and new AWS/GCP checks. • New `prowler oci` provider with full Oracle Cloud Infrastructure support and CIS 3.0 benchmark coverage (CLI). • New `prowler llm` provider for AI/LLM red team security testing via promptfoo, covering OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF with 5000+ test cases (CLI). • Launches the Prowler MCP Server, exposing Prowler Cloud, Hub, and documentation to MCP-compatible AI assistants (Claude Desktop, Cursor) over STDIO or HTTP. • Adds native API key authentication for programmatic access to the Prowler API, suitable for CI/CD and third-party integrations. • Enables PDF export of Prowler ThreatScore reports for stakeholder presentations and compliance audits. • Findings and Findings Severity Overview API endpoints now support `provider_id` and `provider_id__in` filter parameters for multi-cloud reporting. • Adds database read replica support for horizontal scalability, configurable via environment variables. • Adds new check `ec2_instance_with_outdated_ami` for AWS. • Adds new check `cloudstorage_bucket_lifecycle_management_enabled` for GCP. • Adds C5 compliance framework support for AWS (German cloud requirements). • Adds Common Cloud Controls compliance framework across AWS, Azure, and GCP. • Adds certificate-based authentication for M365/Microsoft Entra, replacing deprecated username/password auth. • Standardizes metadata format across 15+ AWS services, including inline NativeIaC and Terraform remediation code. • Adds Prowler Hub menu item and Markdown/AdditionalURLs support in the findings detail UI. Breaking changes: • The `MANAGE_ACCOUNT` permission is now required to modify or read user permissions instead of `MANAGE_USERS`. • M365 username/password authentication is deprecated and no longer supported; certificate-based authentication is required. • At least one user with `MANAGE_ACCOUNT` permission is now required in each tenant. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.12.0

Tue, 09 Sep 2025 10:02:33 GMT

Prowler 5.12.0 adds MongoDB Atlas provider (10 checks), JIRA integration, API status filtering, and token throttling. • New MongoDB Atlas provider (Beta) with 10 security checks covering clusters, projects, and organizations — including TLS, encryption-at-rest, MFA, auditing, and internet-exposure checks. • Sends Prowler findings directly to JIRA projects as Task issues, with labels, finding URLs, tenant info, and color-coded severity for MANUAL findings. • New `--excluded-checks-file` CLI flag lets you supply a file of checks to exclude from a scan. • The `GET /overviews/findings_severity` endpoint now supports `filter[status]` and `filter[status__in]` query parameters to aggregate findings by FAIL or PASS status. • Token endpoint (`/api/v1/tokens`) now supports rate throttling via the `DJANGO_THROTTLE_TOKEN_OBTAIN` environment variable to prevent abuse. • UI: Overview chart 'Findings by Severity' now defaults to showing only FAIL findings and links to the Findings page pre-filtered by severity. • UI: Markdown rendering added to the finding details page. • Adds `AdditionalURLs` field to CheckMetadata for surfacing additional reference URLs on checks. Breaking changes: • FTP and MongoDB EC2 security group checks are renamed to follow the pattern `ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_*` — any scripts, suppressions, or dashboards referencing the old check names will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.11.0

Thu, 28 Aug 2025 14:17:02 GMT

Prowler 5.11.0 adds AWS Security Hub integration, GPT-5 support in Lighthouse AI, 4 new checks, and expanded privilege escalation coverage. • Adds AWS Security Hub integration to automatically forward Prowler findings to Security Hub, with support for session, profile, role, and static credential authentication. • Adds Lighthouse AI support for OpenAI GPT-5, enabling enhanced AI-driven analysis in automated workflows. • Adds new `eks_cluster_deletion_protection_enabled` check to detect EKS clusters without deletion protection. • Adds new `apim_threat_detection_llm_jacking` check for Azure API Management, monitoring 25+ LLM API endpoints across major AI providers. • Adds new `vm_sufficient_daily_backup_retention_period` check to ensure Azure VMs meet a configured minimum daily backup retention period. • Adds new `vm_jit_access_enabled` check to ensure Azure VMs are configured with Just-in-Time access, reducing management port attack surface. • Expands AWS IAM privilege escalation coverage with Bedrock AgentCore combinations, ECS StartTask/RunTask patterns, and updated standalone `iam:PassRole` detection. • Adds Resource Explorer v2 API actions to the `cloudtrail_threat_detection_enumeration` check for broader enumeration detection. • Adds certificate authentication support for the M365 provider. • Adds new `--skip-api-check` command-line flag for GCP provider scans. • Adds a resource agent to Lighthouse AI for querying resource information. • Adds a `Cloud Provider` type filter to the providers page in the UI. • Adds a Mutelist shortcut under the UI Configuration section menu. • Adds direct links to the configured S3 bucket and folder within each integration in the UI. • Generates ASFF output for AWS providers when Security Hub integration is enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.10.0

Thu, 07 Aug 2025 10:00:47 GMT

Prowler 5.10.0 adds GitHub provider, S3 report integration, 5 new security checks, and CIS Azure Benchmark v4.0 support. • Adds GitHub as a supported cloud provider, enabling security posture assessment of GitHub organizations and repositories via Personal Access Tokens, OAuth App Tokens, or GitHub Apps. • Adds `--repository` and `--organization` CLI flags for scoped GitHub scanning, letting you target specific repos or orgs instead of scanning everything. • Adds Amazon S3 integration to automatically deliver scan reports to one or more S3 buckets across any provider combination. • Adds new AWS check `bedrock_api_key_no_administrative_privileges` to detect Bedrock API keys with excessive permissions. • Adds new AWS check `bedrock_api_key_no_long_term_credentials` to detect long-lived credentials in Bedrock API keys. • Adds new AWS check `s3_bucket_shadow_resource_vulnerability` to flag shadow resources in S3 buckets. • Adds new Azure check `vm_desired_sku_size` to validate VMs are configured with the desired SKU size. • Adds new Azure check `vm_scaleset_not_empty` to ensure VM Scale Sets are not empty. • Adds support for CIS Microsoft Azure Foundations Benchmark v4.0 compliance checks. • Adds GCP provider retry configuration support. • Adds Lighthouse banner to the Overview dashboard for enhanced visibility. • Adds XML validation for SAML metadata in the UI. • Adds default Mutelist placeholder in the UI. Breaking changes: • `Memberships` is renamed to `Organization` in the sidebar. • `Browse all resources` is removed from the sidebar; the sidebar now shows a single `Resources` entry. • `Misconfigurations` is removed from the `Top Failed Findings` section in the sidebar. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.9.0

Thu, 17 Jul 2025 16:50:45 GMT

Prowler 5.9.0 adds SAML SSO, mutelist support, a Resource View, remote Git IaC scanning, and 8 new cloud security checks. • Adds Mutelist support: mute findings via the UI or API, with mute reasons visible in finding details and listing views, and instant toggle of muted-finding visibility across all views. • Introduces SAML-based Single Sign-On via a new 'Sign in with SSO' login option, supporting Okta and any SAML-compatible identity provider. • New Resource View provides a unified, browsable inventory of all cloud assets with tags, metadata, provider info, and directly linked findings sorted by FAIL count. • IaC provider now supports scanning remote Git repositories (public and private) via `--scan-repository-url`, enabling direct CI/CD pipeline integration. • Adds 8 new security checks: `entra_intune_enrollment_sign_in_frequency_every_time` for M365, and 7 Azure checks covering SMB encryption, SMB protocol version, VM backup, SSH authentication enforcement, approved VM images, VM scaleset load balancer association, and Defender attack path notifications. • New API endpoints `GET /resources/metadata`, `GET /resources/metadata/latest`, and `GET /resources/latest` expose resource metadata and latest scan results. • New `/processors` API endpoint enables post-processing of findings; currently supports the Mutelist processor for muting findings programmatically. • Enforces stronger password requirements for new sign-ups: minimum 12 characters with uppercase, lowercase, numbers, and special characters, with a real-time strength indicator. • Adds a navigation link in the Scans view to access the Compliance Overview directly. • Adds a Status column to the findings table in the Compliance Detail view. • Adds route access restriction based on user permissions in the UI. • Adds `test_connection` method to the GitHub provider. • `POST /schedules/daily` now returns `409 CONFLICT` if a daily schedule already exists. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.8.1

Thu, 10 Jul 2025 09:57:52 GMT

Prowler 5.8.1 adds `GET /findings/latest` endpoint and custom provider connection exceptions in the API. • Adds `GET /findings/latest` endpoint to retrieve the latest new failed findings • Introduces a custom exception type for provider connection errors during scans in the SDK/API layer Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.8.0

Thu, 03 Jul 2025 13:33:29 GMT

Prowler 5.8.0 adds AI-powered Lighthouse assistant, IaC scanning via Checkov, M365 app-only auth, 21 new checks, and NIS 2 / CIS 4.0 / CIS 1.11 / ISO 27001 compliance frameworks. • Introduces Prowler Lighthouse, an AI-powered cloud security assistant that answers natural-language questions about compliance status, prioritizes failed checks, and suggests remediations — configurable with your own LLM (e.g., GPT-4o Mini) and API key. • Adds IaC scanning powered by Checkov via `prowler iac`, supporting Terraform, CloudFormation, ARM, Kubernetes YAML, and more to catch misconfigurations pre-deployment. • Supports Microsoft 365 app-only (service principal) authentication via OAuth 2.0 client-credentials, enabling fully unattended scans against Exchange Online, SharePoint, Teams, etc. • Adds GCP Service Account Key JSON authentication, allowing GCP onboarding by pasting a key without CLI setup. • Adds 21 new security checks: 1 for AWS, 11 for Azure, 3 for Microsoft 365, and 6 for GitHub. • Adds baseline NIS 2 (EU 2022/2555) compliance support for AWS, Azure, and GCP. • Adds three new compliance frameworks: CIS 4.0 for GCP, CIS 1.11 for Kubernetes, and ISO 27001 for Microsoft 365. • Adds detailed compliance views for all supported frameworks (ENS-RD2022, CIS, ISO, NIST, MITRE ATT&CK, KISA, AWS Well-Architected, etc.) with interactive pie charts, top-failed-sections breakdown, failure heatmaps, and per-category drilldowns. • Adds a 'Resource name' column to the findings table for faster identification of affected resources during triage. • Adds `GET /compliance-overviews` API endpoints to retrieve compliance metadata and per-requirement status metrics. • Adds Lighthouse configuration API support for setting LLM provider, API key, and business context. • Supports `HTTPS_PROXY` and `K8S_SKIP_TLS_VERIFY` environment variables for Kubernetes provider. • Adds new Azure checks: `storage_geo_redundant_enabled` and `storage_cross_tenant_replication_disabled`. • Adds new M365 checks: `entra_users_mfa_capable`, `admincenter_organization_customer_lockbox_enabled`, and `admincenter_external_calendar_sharing_disabled`. • Adds new GitHub check: `repository_has_codeowners_file`. • Revamped User Profile page showing Organization ID, join date, email, active roles, and organization membership with a one-click Organization ID copy action. Breaking changes: • Compliance detailed views are only available for new scans from v5.8.0 onwards; all compliance overviews from previous scans are not available in the new detailed view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.7.3

Fri, 06 Jun 2025 08:42:23 GMT

Prowler 5.7.3 adds database backend for closed API connections • Adds a `Database backend` to handle already closed connections in the Prowler API. Breaking changes: • The `encrypted_password` field is renamed to `password` for the M365 provider. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.7.0

Tue, 20 May 2025 08:22:18 GMT

Prowler 5.7.0 adds GitHub provider with 11 CIS checks, ThreatScore for M365, CIS AWS v5.0 & M365 v4.0 frameworks, and high-performance findings endpoints. • Adds GitHub as a new cloud provider (CLI only) with 11 security checks aligned to CIS GitHub Benchmark v1.0.0. • Adds Prowler ThreatScore support for Microsoft 365, assigning contextual risk scores based on detected misconfigurations. • Adds CIS M365 Benchmark v4.0.0 compliance framework for M365 assessments. • Adds CIS AWS Foundations Benchmark v5.0.0 compliance framework for AWS assessments. • Adds new high-performance API endpoints to retrieve the latest findings and metadata quickly. • Optimizes `/findings/metadata` and resource-related filters for significantly faster querying; optimization applies to scans from this release onward, including `service`, `region`, and `resource_type` filters. • Enhances `/overviews` endpoints for better response times and scalability in large environments. • Adds a new background queue for backfill tasks in the API. • Supports setting cluster name in in-cluster mode for Kubernetes provider. • Adds new passed/failed findings split chart to the UI. • Enhances Provider UID filter in the App with cloud provider icons (AWS, GCP) and alias display for faster multi-cloud analysis. • Adds AWS CloudFormation Quick Link in the IAM Role credentials step for one-click IAM Role stack setup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler

Prowler 5.6.0

Fri, 09 May 2025 09:26:43 GMT

Prowler 5.6.0 adds Microsoft 365 support with 33 new checks, Prowler ThreatScore framework, SOC2 for Azure, and a new GCP unused service accounts check. • Adds Microsoft 365 (M365) provider support with 33 new checks spanning Teams, Defender, Purview, and Exchange for identity governance and risk reduction. • New Prowler ThreatScore compliance framework available for AWS, Azure, and GCP, covering IAM, Attack Surface, Forensic Readiness, and Encryption. • Adds SOC2 compliance framework assessment for Azure (`prowler azure --compliance soc2_azure`), matching existing AWS and GCP SOC2 support. • New GCP check `iam_service_account_unused` detects dormant service accounts to reduce attack surface. • New M365 Teams checks include `teams_external_domains_restricted`, `teams_email_sending_to_channel_disabled`, `teams_meeting_anonymous_user_join_disabled`, `teams_unmanaged_communication_disabled`, `teams_external_users_cannot_start_conversations`, `teams_meeting_anonymous_user_start_disabled`, `teams_meeting_external_lobby_bypass_disabled`, `teams_meeting_dial_in_lobby_bypass_disabled`, `teams_meeting_external_control_disabled`, `teams_meeting_external_chat_disabled`, `teams_meeting_recording_disabled`, `teams_meeting_presenters_restricted`, `teams_security_reporting_enabled`, and `teams_meeting_chat_anonymous_users_disabled`. • New M365 Defender checks cover Common Attachments filter, Outbound Antispam Policy, Antiphishing Policy, Internal user notifications, Bypass Disable for mailboxes, Transport Rules whitelist, Inbound Antispam allowed domains, Connection Filter Policy allowlist/safelist, and DKIM enablement. • New M365 Exchange checks cover Organizations Mailbox Auditing enabled, External Mails Tagged, and Modern Authentication enabled for Exchange Online. • New M365 SharePoint check `sharepoint_onedrive_sync_restricted_unmanaged_devices` restricts OneDrive sync on unmanaged devices. • New `defender_chat_report_policy_configured` check for M365 Defender. • Supports `CLOUDSDK_AUTH_ACCESS_TOKEN` environment variable for GCP authentication. • Prowler Hub launched as a public, searchable library of versioned checks, cloud service artifacts, and compliance frameworks with a documented public API. • Launches Prowler Studio with modular sub-packages (`prowler-studio-core`, `prowler-studio-cli`, `prowler-studio-api`, `prowler-studio-mcp-server`) and MCP Server integration for AI code assistants. • Compliance Exports in the Prowler App now allow downloading individual compliance frameworks from the Compliance page, and scan reports bundle all supported frameworks. • Delta indicator (•) added to findings in the Prowler App to highlight new or changed findings since the previous scan. • Finding URLs in the UI now include the finding ID, enabling direct sharing within an organization. • Adds option to customize the number of items displayed per table page in the Prowler App. • New API endpoint to fetch and download any specific compliance file by name, plus ZIP-export functionality for all compliance reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/prowler