WEBVTT 00:00:01.140 --> 00:00:03.660 Welcome to the final demonstration using Prowler. 00:00:03.980 --> 00:00:07.100 Specifically, you will learn about the reporting options in Prowler. 00:00:07.640 --> 00:00:09.500 This is a relatively short section, 00:00:09.510 --> 00:00:13.410 but important. Documentation is a core skill in cybersecurity, 00:00:13.630 --> 00:00:16.820 and the methods to retrieve results from security software is 00:00:16.820 --> 00:00:19.510 critical to the success of any assessment process. 00:00:19.940 --> 00:00:20.760 In this section, 00:00:20.760 --> 00:00:26.320 we will look at manual reporting on screen, manual reporting to file, and 00:00:26.320 --> 00:00:31.730 automated reporting and alerting. Manual reporting on screen directly 00:00:31.730 --> 00:00:34.890 using the terminal and typing commands, this is relatively 00:00:34.890 --> 00:00:37.460 straightforward and retrieves the latest results. 00:00:37.470 --> 00:00:41.290 However, since this information is on screen, it's not permanent. 00:00:41.620 --> 00:00:44.650 It's recommended to use this for testing and/or development 00:00:44.650 --> 00:00:48.220 purposes or situations where you may be working in a blue team 00:00:48.340 --> 00:00:50.050 and dealing with an active incident, 00:00:50.140 --> 00:00:52.660 maybe working within a security operation center. 00:00:53.440 --> 00:00:57.620 The second method is to run Prowler and save the report to a storage location. 00:00:57.710 --> 00:00:58.670 For example, 00:00:58.680 --> 00:01:02.560 Prowler can run on a Linux system or container either on‑prem 00:01:02.560 --> 00:01:05.310 or in the cloud provided with the necessary access and 00:01:05.310 --> 00:01:07.110 permissions to the cloud environment. 00:01:07.260 --> 00:01:09.730 Reports can then be stored in a central location. 00:01:09.930 --> 00:01:12.300 If your organization requires annual audits, 00:01:12.400 --> 00:01:15.110 then these reports are useful to provide to auditors 00:01:15.120 --> 00:01:16.990 as evidence of meeting compliance. 00:01:17.340 --> 00:01:20.880 Auditors will be able to record that a process exists to improve 00:01:20.880 --> 00:01:24.860 cloud security maturity. Improvements to security over time will be 00:01:24.860 --> 00:01:29.430 reflected within the saved reports. And finally, we have automated 00:01:29.430 --> 00:01:33.350 alerting. The step‑by‑step methods to achieve this are outside of the 00:01:33.350 --> 00:01:34.570 scope of this course. 00:01:34.780 --> 00:01:37.430 There is a detailed solution designed to achieve automated 00:01:37.430 --> 00:01:40.210 alerting available on the AWS website. 00:01:40.500 --> 00:01:41.490 In this solution, 00:01:41.500 --> 00:01:44.820 findings from Prowler are stored and processed within a container 00:01:44.860 --> 00:01:48.360 within the cloud and sent to the AWS Security Hub. 00:01:48.540 --> 00:01:52.190 This means alerts can be prioritized with other AWS‑generated 00:01:52.190 --> 00:01:54.620 security alerts in a centralized manner. 00:01:54.830 --> 00:01:58.960 The author of the solution design is Jonathan Rau, and a link to the solution 00:01:58.960 --> 00:02:01.860 design can be found in the resources section of this course. 00:02:02.240 --> 00:02:05.960 Now you know the different reporting options, let's see this in practice. 00:02:07.940 --> 00:02:11.250 The first, and probably the most useful for integrating into 00:02:11.250 --> 00:02:14.360 solutions, is exporting results to JSON, 00:02:15.040 --> 00:02:18.020 and we can do that by appending the ‑M option, 00:02:18.540 --> 00:02:21.750 followed by the flag json, and that's it. 00:02:22.840 --> 00:02:25.260 And the output to the screen is in JSON format, 00:02:26.040 --> 00:02:29.550 which is ideal for processing with additional tools and processes. 00:02:30.940 --> 00:02:35.760 Next, we can do the same, but for CSV, which is a comma‑separated value. 00:02:36.510 --> 00:02:39.650 And to do that, we swap the json flag to csv. 00:02:40.840 --> 00:02:44.830 This is a useful format if you want to analyze the data, maybe import 00:02:44.830 --> 00:02:48.050 it into Excel for presentation or data comparison. 00:02:49.340 --> 00:02:51.160 Both of those options are on screen, 00:02:51.540 --> 00:02:55.430 but it's very easy to save the data to file, and you can do that by 00:02:55.430 --> 00:02:58.950 forwarding the data using standard output in the terminal. 00:02:59.840 --> 00:03:05.460 And here I am sending the output to reports.csv.txt file. 00:03:06.640 --> 00:03:12.450 Let's look at the file just created, and there are the contents. As you can see, 00:03:12.460 --> 00:03:13.950 very simple to operate. 00:03:15.340 --> 00:03:18.090 So that concludes the final demo section for this course. 00:03:18.840 --> 00:03:19.560 Next up, 00:03:19.570 --> 00:03:22.380 I'll provide some additional information that will help you on 00:03:22.380 --> 00:03:24.690 your way to securing your cloud environments.