Prowler Integration with DefectDojo

Prowler Integration with DefectDojo

Prowler is an open source cloud security tool, licensed under Apache 2.0, created by Toni de la Fuente and now developed by the company Prowler. It runs hundreds of checks against cloud accounts for security best practices and compliance frameworks such as the CIS Benchmarks, covering identity, logging, encryption, networking, and service configuration. Prowler started as an AWS-focused shell script (v2), was rewritten in Python for v3, and now supports several cloud providers. Its reports come in CSV, JSON, and, from v4, OCSF JSON.

Prowler Integration with DefectDojo

We run Prowler against every AWS account on a schedule because it is thorough and free, and because the checks map to the frameworks our auditors ask about. The problem was never coverage. It was turning a few thousand check results into work that someone owns. Importing Prowler output into DefectDojo turns each failed check into a Finding on the Asset for that account, with the affected resource, remediation guidance, and an SLA. The next run's reimport tells us what was fixed and what drifted, instead of producing another file to compare by hand. Teams on DefectDojo Pro that run a self-hosted Prowler App can skip files altogether and let the Prowler connector sync each cloud account's latest scan.

Why Prowler Matters

Most cloud security failures are configuration problems: a public bucket, an unused access key, logging switched off in one region.

• Prowler checks the live configuration of an account, which catches drift that infrastructure as code scanning never sees.
• Its checks map to compliance frameworks, so one run produces evidence for CIS, PCI-DSS, GDPR, and other programs.
• Each failed check names the account, region, and resource, so it can go straight to the team that owns it.
• It runs from your own environment with read-only credentials.
• Raw Prowler output is a point-in-time list. Without a platform, nobody knows whether a failure is new or has been there for six months.

Advantages of This Integration

What we gained by sending Prowler results through DefectDojo:

• Stable identity for v3 and v4 results. The AWS Prowler V3 scan type deduplicates on Prowler's own finding ID, which encodes provider, check, account, region, and resource, so the same failure on the same resource is matched across runs.
• Failures only. For v3 JSON, v4 OCSF, and v2 JSON, only FAIL results are imported, and v4 results muted in Prowler are skipped, so passing checks don't clutter the Test.
• Resource-level ownership. v3 and v4 findings carry the resource ARN as the component, which makes it easy to filter and assign by resource.
• Drift as a delta. Reimporting each run into the same Test mitigates findings for resources that were fixed and adds anything that newly fails.
• Exceptions with expiry. Intentional configurations can be risk-accepted with a reason and an end date rather than suppressed and forgotten.
• Scheduled sync from Prowler App (DefectDojo Pro). The Prowler connector reads the Prowler App REST API, creates a Record per provider (cloud account), and can split findings further by service or resource.

How This Integration Works

DefectDojo has two scan types for the formats on this page. Pick the one that matches your Prowler version.

AWS Prowler Scan (Prowler v2). Accepts the CSV (-M csv) or line-delimited JSON (-M json) output of the older shell-based Prowler. The parser picks the format by file extension, so keep .csv or .json on the file.

./prowler -M csv

AWS Prowler V3 (Prowler v3 and v4). Accepts Prowler v3 native JSON (.json) and Prowler v4 OCSF JSON (.ocsf.json). The extension decides which format is parsed, so keep the .ocsf.json suffix Prowler writes for OCSF output.

prowler aws -M json-ocsf

For Prowler v3, use prowler aws -M json. DefectDojo also has a separate Prowler Scan type for current multi-cloud Prowler CSV and JSON output from AWS, Azure, Google Cloud, and Kubernetes, if you scan beyond AWS.

Import the file. In the UI, open the Engagement, choose Import Scan Results, select the scan type, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=AWS Prowler V3" \
  -F "file=@prowler-output-prod.ocsf.json" \
  -F "product_name=aws-prod-account" \
  -F "engagement_name=Cloud Posture" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "AWS Prowler V3" \
  --report-path "./prowler-output-prod.ocsf.json" \
  --product-name "aws-prod-account" \
  --engagement-name "Cloud Posture" \
  --auto-create-context

Reimport each run. Send later reports for the same account to /api/v2/reimport-scan/ against the same Test.

Option: Prowler connector (DefectDojo Pro). This requires a running, self-hosted Prowler App with at least one cloud account connected and scanned. In the DefectDojo Pro UI, enter the Prowler App URL in Location (for example https://prowler.your-company.com). Authenticate with a Prowler App user Email and Password (JWT), or leave those blank and enter a Prowler App API Key; if both are given, email and password are used. Optionally set a Minimum Severity. Under Import Filters, Asset Grouping chooses one Record per provider (default), per service, or per resource, and Organization Placement can create an Organization per provider or per cloud type for new Assets.

Data Granularity: What Gets Imported

The table covers AWS Prowler V3 (v3 JSON and v4 OCSF).

AWS Prowler Scan (v2) differences. Titles come from the check result message. Severity uses CHECK_SEVERITY for failing checks, with Informational raised to Low; if no severity is present, Level 1 failures become Critical and others High. In CSV imports, PASS and INFO rows are imported as inactive Info findings, while JSON imports keep only FAIL. The description lists account, region, CIS control, Prowler check number, service, and ASFF types. Deduplication uses a hash of title, CWE, line, file path, and description.

Within one report, both scan types merge repeated entries (by finding ID for V3, or by severity, region, and message for v2) and count occurrences.

Connector findings (DefectDojo Pro). The connector imports only the FAIL findings of each provider's latest completed scan and skips muted findings. It maps Prowler severities to DefectDojo severities, uses the affected cloud resource (ARN or resource ID) as the component, carries the check's remediation and risk into the finding, and attaches cloud account, region, and service as tags.

Use Cases

For nightly posture checks: A scheduled job runs Prowler v4 against each production account and reimports the OCSF output. The security team reviews the overnight delta each morning.

When onboarding a new AWS organization: The first scan of an acquired company's accounts often returns hundreds of failures. Importing each account into its own Asset lets the team triage in bulk, risk-accept intentional settings, and set SLAs for the rest.

For compliance evidence: Prowler's checks map to frameworks like CIS and PCI-DSS. DefectDojo keeps the date each failure was found and closed, which is what auditors ask to see.

When upgrading Prowler versions: Teams moving from v2 to v4 can import both formats into the same Asset for a cycle to compare coverage before retiring the old job.

Operational Tips

• Map one AWS account to one Asset. It keeps ownership clear and per-account metrics meaningful.
• Keep file extensions intact. Both scan types choose the parser by extension, and a renamed OCSF file ending in plain .json is read as v3 JSON.
• Mute accepted findings in Prowler v4 if you prefer to manage exceptions there; muted results are skipped on import. Otherwise, risk-accept them in DefectDojo with an expiration date.
• For v2 CSV, set minimum_severity=Low or filter on active status, since PASS and INFO rows arrive as inactive Info findings.
• Don't switch between AWS Prowler Scan and AWS Prowler V3 in the same Test. They use different deduplication methods, so reimports would not match.
• If you switch the connector's Asset Grouping to service or resource, enable Auto Map on the connection first so findings move to the new Records without a gap. Expect longer syncs, since the connector makes one Prowler App request per Record.
• Tag imports with account and environment (for example tags=aws,prod) to filter dashboards by cloud estate.