Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
defender_auto_provisioning_log_analytics_agent_vms_on
Microsoft Defender for Cloud auto-provisioning of the Log Analytics agent to Azure VMs is configured to On at the subscription level
defender_auto_provisioning_vulnerabilty_assessments_machines_on
Microsoft Defender for Cloud evaluates whether Azure VMs and Arc-enabled machines have a vulnerability assessment solution deployed and reporting healthy coverage across the subscription.
defender_container_images_resolved_vulnerabilities
Running container images are evaluated for unresolved vulnerability findings (CVEs) reported by Microsoft Defender for Cloud. The check reviews images currently in use across Kubernetes workloads and identifies where vulnerabilities remain unremediated.
defender_container_images_scan_enabled
Azure subscriptions have container image vulnerability assessment enabled for Azure Container Registry via Microsoft Defender for Cloud (ContainerRegistriesVulnerabilityAssessments). Images in registries are evaluated for known package vulnerabilities in their packages and dependencies.
defender_ensure_defender_cspm_is_on
Microsoft Defender for Cloud Cloud Security Posture Management (CSPM) plan is evaluated for standard tier activation. Defender CSPM provides advanced posture management capabilities including attack path analysis, cloud security explorer, agentless scanning, and governance rules.
defender_ensure_defender_for_app_services_is_on
Azure subscriptions are evaluated for Defender for App Service coverage by inspecting the AppServices pricing configuration. The finding indicates whether the plan is set to Standard, which applies protection to App Service resources at the subscription scope.
defender_ensure_defender_for_arm_is_on
Microsoft Defender for Cloud plan for Azure Resource Manager is configured at the Standard tier for the subscription
defender_ensure_defender_for_azure_sql_databases_is_on
Microsoft Defender for Cloud plan for Azure SQL Database Servers is evaluated at subscription scope, expecting the pricing_tier set to Standard for SqlServers. Non-standard tiers indicate the plan isn't enabled.
defender_ensure_defender_for_containers_is_on
Azure subscriptions are assessed to determine if the Defender for Containers plan is configured with pricing tier Standard.
defender_ensure_defender_for_cosmosdb_is_on
Microsoft Defender for Azure Cosmos DB is enabled at the subscription using the Standard pricing tier for the CosmosDbs plan, covering all Cosmos DB accounts
defender_ensure_defender_for_databases_is_on
Azure subscription is evaluated for Defender for Databases coverage: Standard pricing must be enabled for SqlServers, SqlServerVirtualMachines, OpenSourceRelationalDatabases, and CosmosDbs.
defender_ensure_defender_for_dns_is_on
Microsoft Defender for DNS is configured at the Standard tier for the subscription's Defender pricing
defender_ensure_defender_for_keyvault_is_on
Azure subscriptions are evaluated for the Defender for Key Vaults plan configured at the Standard tier. It identifies where Key Vault protection uses this tier versus where the Defender pricing for KeyVaults is not set accordingly.
defender_ensure_defender_for_os_relational_databases_is_on
Microsoft Defender for Cloud plan for Open-Source Relational Databases is evaluated for the Standard pricing tier at the subscription level.
defender_ensure_defender_for_server_is_on
Microsoft Defender for Servers subscription plan (VirtualMachines) is configured to the Standard tier. The evaluation checks whether the Servers plan is enabled at this level for all server workloads in the subscription.
defender_ensure_defender_for_sql_servers_is_on
Subscription pricing for Defender for SQL Server on Machines is configured to the Standard plan, covering SQL Server instances running on virtual machines.
defender_ensure_defender_for_storage_is_on
Azure subscription's Defender for Storage plan is set to Standard for Storage Accounts.
defender_ensure_iot_hub_defender_is_on
Microsoft Defender for IoT security solution exists in the subscription and reports status Enabled for monitored IoT Hub resources.
defender_ensure_mcas_is_enabled
Subscription settings contain the MCAS integration for Microsoft Defender for Cloud Apps, and the setting is enabled.
defender_ensure_notify_alerts_severity_is_high
Microsoft Defender for Cloud email notifications use a minimum alert severity of High or more inclusive (Medium/Low). The evaluation inspects security contacts to confirm a threshold is defined and not Critical.
defender_ensure_notify_emails_to_owners
Microsoft Defender for Cloud email notifications target subscription users in the Owner role through role-based recipients.
defender_ensure_system_updates_are_applied
Azure VMs are evaluated for:
defender_ensure_wdatp_is_enabled
Azure subscription integrates Microsoft Defender for Endpoint with Defender for Cloud via WDATP. The setting's presence and enabled state at the subscription scope are evaluated.
entra_app_registration_credential_not_expired
Microsoft Entra ID app registrations are evaluated for credential validity. Each app's password secrets and certificate credentials are checked for expiration. Credentials that are already expired, expiring within 30 days, or have no expiration date are flagged.