Prowler

Prowler Integration with DefectDojo

Prowler is one of the most capable open-source cloud security tools available — purpose-built for assessing AWS, Azure, GCP, and Kubernetes environments against hundreds of security checks spanning CIS benchmarks, SOC 2, PCI DSS, HIPAA, GDPR, ISO 27001, and NIST frameworks. For security teams that need breadth of cloud security coverage without commercial CSPM licensing costs, Prowler is a natural fit. The challenge is operational: Prowler produces rich, structured findings on every run, but those findings need to move into a workflow. Without a vulnerability management platform behind it, Prowler output lives in JSON files and CI logs — not in a system where remediation is tracked, SLAs are enforced, and risk decisions are documented. Integrating Prowler with DefectDojo closes that gap, turning cloud security assessment output into a managed, auditable remediation program across your entire cloud estate.

Why Prowler Matters

Prowler has evolved from an AWS-focused auditing script into a mature, multi-cloud security platform with a check library covering thousands of controls across all major cloud providers.

• Prowler's check library spans AWS, Azure, GCP, and Kubernetes with over 300 checks across services including IAM, S3, EC2, RDS, Lambda, CloudTrail, CloudWatch, KMS, VPC, EKS, and more — giving comprehensive coverage of the attack surface most cloud environments expose
• It maps findings to established compliance frameworks out of the box: CIS Foundations Benchmarks for AWS, Azure, and GCP; SOC 2; PCI DSS; HIPAA; ISO 27001; FedRAMP; GDPR; and NIST 800-53 — making it immediately useful for teams with formal compliance requirements
• Prowler v3 and later produce output in JSON-OCSF (Open Cybersecurity Schema Framework) format alongside its native JSON, CSV, and HTML formats — the JSON output is what DefectDojo consumes for structured finding import
• Its agentless architecture requires only cloud API credentials (IAM role, service principal, or service account) — no agents, no infrastructure to maintain, and no impact on running workloads
• Prowler can be run as a CLI tool, in CI/CD pipelines, as a scheduled AWS Lambda function, or via Prowler Cloud — giving teams flexibility in how they operationalize continuous assessment
• The open-source nature allows security teams to write custom checks in Python when built-in checks don't cover organization-specific policies or services

Advantages of This Integration

Prowler tells you where your cloud configuration deviates from security best practice. DefectDojo tracks whether your team fixed it — and maintains the record of every decision made along the way.

• Persistent finding records across cloud assessment cycles: Cloud configurations change continuously. Reimporting Prowler findings into DefectDojo on a regular schedule updates finding status automatically — misconfigurations that were remediated since the last assessment are marked resolved, new issues are created, and findings that have been open for months without action are surfaced by their age rather than re-triaged from scratch.
• SLA enforcement for cloud misconfigurations: DefectDojo applies configurable SLA policies by severity across all imported Prowler findings. Critical cloud security issues get remediation deadlines; High severity misconfigurations get 30-day targets. Breach tracking and alerting surface overdue findings in dashboards — something Prowler's native output formats cannot provide between assessment cycles.
• Multi-account and multi-cloud portfolio visibility: Organizations running Prowler across multiple AWS accounts, Azure subscriptions, or GCP projects get aggregated findings across their entire cloud estate in DefectDojo — filterable by severity, check type, cloud provider, and age — without manually reviewing individual assessment outputs per account or project.
• Compliance framework tracking over time: Prowler maps findings to compliance controls. DefectDojo retains that mapping across reimports, enabling trend analysis of compliance posture over time — which controls are consistently failing, which were remediated and re-introduced, and where coverage gaps exist relative to framework requirements.
• Risk acceptance with documented rationale: Not every Prowler finding warrants remediation. Compensating controls, architectural decisions, or accepted residual risk are all legitimate outcomes. DefectDojo captures the justification, approver, and expiration date for every risk acceptance — auditable across re-assessments and available for compliance review without hunting through email threads or ticketing comments.
• Cross-team remediation routing: Cloud misconfigurations span multiple owners — IAM findings go to the identity team, S3 findings go to the data platform team, EC2 findings go to infrastructure, Kubernetes findings go to platform engineering. DefectDojo's assignment model routes each finding to the right owner with the right context, without a manual triage handoff for every assessment cycle.
• Ticketing integration for remediation workflow: Triaged Prowler findings push from DefectDojo to Jira, ServiceNow, or GitHub Issues with check name, affected resource, severity, and remediation guidance included — giving infrastructure teams actionable context without requiring access to Prowler output or cloud consoles.

How This Integration Works

Prowler produces JSON output via its CLI that DefectDojo's Prowler parser consumes directly. The integration covers all supported cloud providers from a single scan type.

Step 1 — Run Prowler and capture JSON output

Install Prowler:

pip install prowler

Run against AWS with JSON output:

# Full AWS assessment with JSON output

prowler aws --output-formats json --output-directory ./prowler-output

# Target specific compliance framework

prowler aws --compliance cis_level2_aws --output-formats json \

--output-directory ./prowler-output

# Scan a specific AWS region

prowler aws --region us-east-1 --output-formats json \

--output-directory ./prowler-output

# Filter by severity

prowler aws --severity critical high --output-formats json \

--output-directory ./prowler-output

Run against Azure:

prowler azure --output-formats json --output-directory ./prowler-output

Run against GCP:

prowler gcp --output-formats json --output-directory ./prowler-output

Run against Kubernetes:

prowler kubernetes --output-formats json --output-directory ./prowler-output

Prowler writes output files to the specified directory. The JSON file will follow the naming pattern prowler-output-<timestamp>.json.

Step 2 — Import into DefectDojo

Use Prowler Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Prowler Scan" \

-F "file=@./prowler-output/prowler-output-<timestamp>.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring assessments

For environments assessed on a regular schedule, use the reimport endpoint to update existing findings rather than accumulate redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Prowler Scan" \

-F "file=@./prowler-output/prowler-output-<timestamp>.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new assessment as resolved, creates records for new findings, and leaves previously accepted or false-positived findings untouched.

Data Granularity: What Gets Imported

Use Cases

For continuous AWS security posture management: Prowler runs daily against all AWS accounts via a scheduled Lambda function or CI pipeline job. Results import into DefectDojo, organized by account under a product-per-account structure. Security engineers triage new findings weekly, assign remediation to the relevant infrastructure team, and track SLA compliance through DefectDojo dashboards. Risk acceptances for architectural decisions — for example, accepting public S3 bucket access for a CDN origin — are documented in DefectDojo with expiration dates rather than living as undocumented exceptions in Prowler's ignore list.

For multi-cloud compliance tracking: An organization with workloads across AWS, Azure, and GCP runs Prowler against all three environments. DefectDojo aggregates findings across cloud providers under a unified product structure, with CIS benchmark and compliance framework mappings preserved on each finding. Security leadership gets a cross-cloud compliance posture view showing which controls are consistently failing, which have been remediated, and which are risk-accepted — without generating separate reports from each cloud provider's native tooling.

During a pre-audit compliance preparation: Ahead of a SOC 2 or PCI DSS audit, the security team runs Prowler with the relevant compliance framework filter (--compliance soc2 or --compliance pci_4.0_aws) and imports results into a dedicated DefectDojo engagement. Findings are triaged, remediated, and re-assessed in a second Prowler run reimported into the same engagement. The before-and-after record in DefectDojo provides auditors with structured evidence of identified gaps and documented remediation — without manual report compilation.

For Kubernetes cluster security assessment: Platform engineering teams run Prowler's Kubernetes checks against production clusters as part of their security review process. Findings covering RBAC over-permissions, missing pod security standards, exposed dashboards, and network policy gaps import into a dedicated DefectDojo engagement for cluster security. Platform and security teams jointly triage findings, apply risk acceptances where compensating controls exist, and track remediation across subsequent Prowler reimports — replacing ad-hoc spreadsheet tracking with a managed workflow.

For new cloud account onboarding: When a new AWS account or Azure subscription is provisioned, an automated Prowler scan runs as part of the account bootstrap process. Results import into a DefectDojo engagement tied to the new account. The security team reviews the baseline finding set, documents accepted architectural decisions, and establishes the initial posture record — ensuring every account in the estate has a tracked security baseline from day one rather than accumulating undiscovered debt.

Operational Tips

• Structure DefectDojo products to match your cloud account hierarchy: A product-per-AWS-account, product-per-Azure-subscription, or product-per-GCP-project mapping keeps ownership clear and SLA tracking meaningful. For organizations with many accounts, a product-per-business-unit structure that groups related accounts under a single product can reduce management overhead while preserving team-level accountability.
• Use compliance framework filters to scope targeted assessments: Prowler's --compliance flag limits output to checks relevant to a specific framework. Running framework-targeted assessments and importing them into dedicated DefectDojo engagements keeps compliance evidence organized by framework — useful for producing audit packages without mixing CIS findings with PCI findings in the same engagement.
• Set assessment schedules to match SLA windows: If your Critical SLA is 48 hours and Prowler runs weekly, DefectDojo won't have the data to track SLA compliance accurately for issues that emerge between runs. For production cloud environments, daily assessments with automated reimport provide the data freshness that meaningful SLA tracking requires.
• Use --severity critical high filtering for production pipelines: Full Prowler assessments against large cloud environments can produce hundreds of findings including Medium and Low severity items that aren't immediately actionable. Filtering to Critical and High for the primary import keeps your active DefectDojo queue focused on real risk, while running full assessments on a slower cadence for completeness.
• Tag findings by cloud provider, account, and service on import: DefectDojo finding-level tags enable filtering and reporting across your cloud estate by provider (aws, azure, gcp), account ID, and cloud service (iam, s3, ec2). This tag structure makes it possible to answer questions like "show me all open IAM findings across our production AWS accounts" without navigating product-by-product.
• Document architectural exceptions as risk acceptances, not scanner suppression: Prowler supports check-level exclusions via --excluded-checks. Where possible, prefer managing exceptions as risk acceptances in DefectDojo instead — the rationale is documented, tied to an approver, and carries an expiration date. Scanner-side exclusions are invisible to auditors and don't expire automatically.
• Pair Prowler with runtime security tooling for defense-in-depth: Prowler assesses configuration — what your cloud environment is set up to allow. It doesn't detect active exploitation or runtime anomalies. Pairing Prowler findings in DefectDojo with runtime security findings from tools like GuardDuty or Falco gives a more complete picture of cloud risk in a single platform — CSPM coverage alongside active threat detection.
• Run Prowler with assumed roles for consistent multi-account coverage: In AWS organizations, use a central automation account with cross-account IAM roles to run Prowler across all member accounts from a single pipeline. This avoids credential management sprawl and ensures every account is assessed on the same schedule — gaps in multi-account coverage are a common source of undetected cloud security debt.