Welcome to the final demonstration using Prowler.
Specifically, you will learn about the reporting options in Prowler.
This is a relatively short section,
but important. Documentation is a core skill in cybersecurity,
and the methods to retrieve results from security software is
critical to the success of any assessment process.
In this section,
we will look at manual reporting on screen, manual reporting to file, and
automated reporting and alerting. Manual reporting on screen directly
using the terminal and typing commands, this is relatively
straightforward and retrieves the latest results.
However, since this information is on screen, it's not permanent.
It's recommended to use this for testing and/or development
purposes or situations where you may be working in a blue team
and dealing with an active incident,
maybe working within a security operation center.
The second method is to run Prowler and save the report to a storage location.
For example,
Prowler can run on a Linux system or container either on‑prem
or in the cloud provided with the necessary access and
permissions to the cloud environment.
Reports can then be stored in a central location.
If your organization requires annual audits,
then these reports are useful to provide to auditors
as evidence of meeting compliance.
Auditors will be able to record that a process exists to improve
cloud security maturity. Improvements to security over time will be
reflected within the saved reports. And finally, we have automated
alerting. The step‑by‑step methods to achieve this are outside of the
scope of this course.
There is a detailed solution designed to achieve automated
alerting available on the AWS website.
In this solution,
findings from Prowler are stored and processed within a container
within the cloud and sent to the AWS Security Hub.
This means alerts can be prioritized with other AWS‑generated
security alerts in a centralized manner.
The author of the solution design is Jonathan Rau, and a link to the solution
design can be found in the resources section of this course.
Now you know the different reporting options, let's see this in practice.
The first, and probably the most useful for integrating into
solutions, is exporting results to JSON,
and we can do that by appending the ‑M option,
followed by the flag json, and that's it.
And the output to the screen is in JSON format,
which is ideal for processing with additional tools and processes.
Next, we can do the same, but for CSV, which is a comma‑separated value.
And to do that, we swap the json flag to csv.
This is a useful format if you want to analyze the data, maybe import
it into Excel for presentation or data comparison.
Both of those options are on screen,
but it's very easy to save the data to file, and you can do that by
forwarding the data using standard output in the terminal.
And here I am sending the output to reports.csv.txt file.
Let's look at the file just created, and there are the contents. As you can see,
very simple to operate.
So that concludes the final demo section for this course.
Next up,
I'll provide some additional information that will help you on
your way to securing your cloud environments.