Where can we find the list of all the rules of CIS, GDPR and HIPAA against which the checks are done?

[RenukaMane]

We are exploring Prowler and wanted to see the list of all the rules of CIS, GDPR and HIPAA against which Prowler makes the checks.
Also is it possible to run Prowler using a CI/CD Pipeline?

[jfagoagas]

Hi @RenukaMane, thank you for your question!

1. In Prowler 2.X you can find the information about the compliance rules that are checked in the compliance group files:

• HIPAA --> https://github.com/prowler-cloud/prowler/blob/master/groups/group10_hipaa
• CIS Level 1--> https://github.com/prowler-cloud/prowler/blob/master/groups/group5_cislevel1
• CIS Level 2 --> https://github.com/prowler-cloud/prowler/blob/master/groups/group6_cislevel2
• GDPR --> https://github.com/prowler-cloud/prowler/blob/master/groups/group9_gdpr

2. Regarding the CI/CD pipeline, you can run Prowler with the -Z or -z options not to trigger the exit code 3 when some check raise a FAIL. https://github.com/prowler-cloud/prowler/blob/master/prowler#L121-L122
   That options are to be use in a CI/CD pipeline if you don't want to abort your execution, but if you want it you can run you Prowler command inside your pipeline without any problem, just make sure that you have properly configured your AWS credentials.

Thanks!

[vishalgoyal16444]

@jfagoagas : Thanks for your response. We have checked these files. How do we get the actual rules for each of these checks in a single document / excel.

We are trying to look at prowler and taking it to our cloud security team to leverage on projects to improve cloud security posture. And we need to know the actual rules which it checks against especially for HIPAA and GDPR.

Thanks.

[vishalgoyal16444]

@jfagoagas : Can you please advise on this

[jfagoagas]

Hi @RenukaMane, we don't have all of this information in a single document but you can use the following command to inspect the checks belonging each group, e.g.: ./prowler -l -g gdpr or ./prowler -l -g hipaa

Remember that Prowler is only a helper to guide you to meet the requirements for all those security frameworks.

Thanks!