Cloud posture (Prowler)
Cloud posture assessments use Prowler to check your cloud accounts for misconfigurations. Each failed check becomes a tracked vulnerability on the account or resource it affects. You also get a compliance summary for each framework and Prowler's full report. There are two ways to run them: Connected cloud accounts on our cloud scanners. You give our read-only app access in your cloud, and our cloud scanners run the assessment. You never give us a password or secret. Prowler on your own sensor. You save a read-only cloud credential under Credentials, and one of your sensors runs the assessment. [!NOTE] Each way depends on your plan (see Subscription). If your plan doesn't include connected cloud accounts, Cloud accounts isn't shown in the menu. Connected cloud accounts Go to Cloud accounts. Only people who manage sensors can connect, change or disconnect accounts: the Administrator role, organisation owners and admins, and personal accounts. Connect Azure Select Connect Azure. You're sent to Microsoft. An administrator of your Microsoft tenant grants admin consent to our app. Microsoft then asks you to sign in to the same tenant. The person who signs in must hold one of these roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator. You're returned to Cloud accounts with the message "Connected. Finish the setup below." Choose the subscriptions to assess, and select Save subscriptions. For each new subscription, we use your sign-in to give our app two roles: the built-in Reader role a small custom role that can read Function App keys and configuration You need Owner or User Access Administrator on each subscription you add. If we can't add our roles to a subscription, it stays unselected and the reason is shown next to it. Your Azure sign-in lasts an hour. To add subscriptions later, open the account, select Sign in to Azure and choose again. The account's status shows how many subscriptions are assessed, or Choose subscriptions if none are selected yet. Connect Microsoft 365 Select Connect Microsoft 365. Grant admin consent, then sign in as an administrator, as in steps 2 to 4 for Azure. The Entra ID, SharePoint, Intune and Defender checks work straight away. Exchange and Teams checks need our app to hold the read-only Global Reader role. In the Entra admin center, go to Roles and administrators > Global Reader > Add assignments, and add "Orbital Cyber – Microsoft 365 posture". Back on the account, select Check access. Until the role is assigned, the status shows Needs Global Reader for Exchange and Teams. After that it shows Ready. AWS and Google Cloud Connecting AWS accounts and Google Cloud projects to our cloud scanners is coming soon. Until then, you can assess them with Prowler on your own sensor. What counts against your plan Each Azure subscription you select and each Microsoft 365 tenant counts as one cloud account. The page shows how many your plan allows and how many you're using. A Microsoft tenant can be connected to only one OrbitalCyber account at a time. You can connect up to 50 cloud accounts. Check access Open an account and select Check access to test our access again. Next to each Azure subscription you'll see Assessed, or No access yet if our roles aren't in place. Run an assessment on a cloud scanner Go to Scans and select New scan. For Sensor, choose a cloud scanner under Cloud scanners. For Scan type, choose Cloud posture: connected cloud accounts (Prowler). If the option shows "not available on this cloud scanner", choose another cloud scanner. For Connected account, choose the account. An Azure account covers its selected subscriptions. A Microsoft 365 account covers the tenant. Start the scan. Disconnect and remove our access To stop assessing an Azure subscription, clear it and save. To also remove our access, remove our app's roles in that subscription's Access control (IAM). To disconnect an account, select the delete icon on its row…
OrbitalCyber documentation