Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
network_rdp_internet_access_restricted
Azure NSG inbound rules are evaluated for public RDP exposure. The finding flags rules that Allow TCP traffic to port 3389 from broad sources like 0.0.0.0/0, Internet, or *, including ranges that cover 3389.
network_reserveip_floating_ip_unattached
E2E Networks floating (reserved) IP addresses should be attached to a node instead of being left unassigned, since idle floating IPs can be reassigned unexpectedly.
network_reserveip_orphaned_public_ip
E2E Networks public and addon reserved IP addresses should be attached to a resource, identifying orphaned addresses that remain internet-reachable without an owner.
network_security_group_ingress_from_internet_to_rdp_port
OCI Network Security Groups are evaluated for inbound source 0.0.0.0/0 permitting RDP on TCP 3389, including broad rules (all TCP or any protocol) that implicitly include that port.
network_security_group_ingress_from_internet_to_ssh_port
Network security groups with ingress from 0.0.0.0/0 exposing SSH are identified. This includes rules that explicitly permit TCP 22, use all protocols, or define TCP port ranges that encompass 22.
network_security_list_ingress_from_internet_to_rdp_port
OCI security lists are evaluated for rules that permit inbound RDP from the Internet: any source 0.0.0.0/0 allowing TCP 3389-including rules that allow all TCP ports or all protocols-signals public RDP exposure.
network_security_list_ingress_from_internet_to_ssh_port
OCI security lists are evaluated for rules that permit inbound SSH from 0.0.0.0/0. Any rule where the destination includes TCP 22-or broader rules allowing all TCP or all protocols from 0.0.0.0/0-indicates public SSH exposure.
network_ssh_internet_access_restricted
Azure NSG inbound rules that allow SSH on TCP 22 from 0.0.0.0/0, Internet, or * are identified, including rules where port ranges include 22 and protocol is TCP or *.
Indicates NSGs exposing SSH to the Internet.
network_subnet_nsg_associated
Azure Virtual Network subnets are evaluated for Network Security Group (NSG) association. Each subnet should have an NSG to enforce inbound and outbound traffic filtering rules. Subnets without NSGs allow all traffic by default.
network_udp_internet_access_restricted
Azure NSG rules are assessed for inbound UDP exposure to the public Internet (e.g., 0.0.0.0/0, *, Internet). The finding identifies allow rules that permit unsolicited UDP traffic from any external source to attached resources.
network_vcn_subnet_flow_logs_enabled
OCI subnets in a VCN have network flow logging configured. Evaluation considers an active flowlogs configuration targeting the VCN or the specific subnet in the same region and associated with a log group.
network_vnet_ddos_protection_enabled
Azure Virtual Networks are evaluated for DDoS Network Protection. When enabled, Azure DDoS Protection provides enhanced mitigation against volumetric, protocol, and application-layer DDoS attacks targeting resources deployed in the virtual network.
network_vpc_has_attached_nodes
E2E Networks VPCs should have at least one node attached, identifying unused network segments that may indicate misconfiguration or forgotten resources.
network_vpc_has_empty_routingtables
Check if VPC has empty routing tables. Having empty routing tables may indicate misconfiguration or incomplete network setup.
network_vpc_is_active
E2E Networks VPCs should be in the active state so that attached workloads retain expected connectivity and network isolation.
network_vpc_peering_external_peer_disabled
E2E Networks VPC peering connections should be established only with internal networks and must not extend trust to external peers outside the account.
network_vpc_subnet_enable_dhcp
Check if DHCP is enabled for the subnets in the VPC.
network_vpc_subnet_has_external_router
Checks if VPC allows access from the public internet, by verifying if an external router is configured.
network_watcher_enabled
Azure Network Watcher presence across the subscription's regions. The assessment checks that a Network Watcher instance exists in every subscription location where resources may be deployed.
network_zone_block_anonymized_proxies
Okta Network Zone blocklists should block anonymized proxy access before authentication. Enhanced Dynamic Zone anonymizer categories provide direct coverage; static IP blocklists show gateway/proxy blocking but cannot prove full anonymizer-provider coverage.
Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
When publishing web applications, use a load balancer instead of publishing directly to instances.
Security groups should include a description for auditing purposes.
Simplifies auditing, debugging, and managing security groups.
Security group rules should include a description for auditing purposes.
Simplifies auditing, debugging, and managing security groups.
Need to add a security group to your instance.