Prowler Reporting,
Every Failed Check Triaged
Prowler reporting straight from its own output. Every failed check lands in one triage queue with its affected resources, remediation code, and compliance mappings.
Import Once. Report From One Place.
Prowler runs hundreds of checks against an AWS, Azure, or Google Cloud account and reports every one of them, pass or fail, once per resource. That is exactly what an auditor wants and exactly what a pentest report cannot use as it is. Neuron imports it into a triage queue instead.
Import the OCSF JSON, the native JSON, or the CSV that Prowler writes, and every failing check becomes one scan issue with each failing resource listed under it by ARN or resource ID, region, account, and type. Prowler's risk text, remediation guidance, CLI and Terraform fixes, references, and compliance mappings come with it.
Upload the file in the browser, or run neuron import on it from wherever Prowler ran. Passing checks are skipped, so the queue only holds what needs a decision.
$ prowler aws --profile acme-audit \ -M json-ocsf csv -o ./prowler Scan complete: 412 FAIL, 1960 PASS $ neuron import ./prowler/*.ocsf.json✓ Prowler: 58 issues, 412 resources- 10:48 Finding S3 buckets allow public access
- 10:41 Import Prowler: 58 issues, 412 resources
- 10:36 Command prowler aws -M json-ocsf csv
- 09:52 Import Prowler: 23 issues, Azure subscription
Why Prowler Reporting Takes So Long
A Prowler scan of a single AWS account can produce thousands of rows, because every check is evaluated against every bucket, role, security group, and region. The few failures that matter to the client sit among hundreds of passes and low-severity hygiene checks.
So cloud security assessment reports get built by filtering a CSV in a spreadsheet, collapsing duplicate rows by hand, and pasting resource ARNs into a findings table. Do that across a client's production, staging, and shared services accounts and the same check appears three times with three different resource lists.
Then the client remediates, the scan is rerun, and nobody can say with confidence which of the original resources are still exposed.
Everything Prowler Produces, On the Engagement
Import Prowler output from the browser or with neuron import, and it lands the moment the import finishes.
One Issue per Check
Prowler's per-resource rows grouped into one scan issue per check and account, so s3_bucket_public_access is one decision, not forty rows.
Affected Resources
Every failing resource under its issue, with resource UID or ARN, name, region, account, type, tags, and the status detail Prowler gave for why it failed.
Remediation Code
Prowler's recommendation text plus the CLI, Terraform, and native IaC fixes it ships for the check, kept on the issue for the finding to use.
Compliance Mappings
The frameworks Prowler maps each check to, such as CIS, NIST 800-53, and PCI-DSS, shown on the scan issue next to its references.
Provider and Service
Each issue carries its cloud provider and the service from its check ID, so the queue groups by Provider or Service in one click and filters by account.
Rescans That Reconcile
Import the next run and existing issues update in place instead of duplicating. Checks that no longer fail are marked fixed.
How to Import Prowler Results
- 01
Run Prowler with machine-readable output
Prowler writes CSV and OCSF JSON alongside its HTML report. Neuron reads the OCSF JSON, the native JSON from Prowler v3, or the semicolon-delimited CSV, so whatever you kept will import.
$ prowler aws --profile acme-audit -M json-ocsf csv -o ./prowler - 02
Repeat per account
Run Prowler once for each AWS account, Azure subscription, or Google Cloud project in scope, each with its own profile. Issues stay scoped to the account they came from, so production and staging never blur together.
$ prowler aws --profile acme-staging -M json-ocsf -o ./prowler - 03
Import the results
Point neuron import at the OCSF file and the format is detected from its content. For the CSV, name the importer with --source prowler. Each file is its own import, so one file per account is fine.
$ neuron import ./prowler/*.ocsf.json - 04
Or upload it in the browser
Open the engagement, choose Import, and pick Prowler under Cloud Security. The same file lands in Scan Issues, ready to group by Provider or Service.
Your Infrastructure. Your Data.
Neuron is self-hosted. Import Prowler results from the browser or the CLI and they land on your own server, inside your network. Scan data never passes through a third-party cloud.
From Prowlerto the Final Report
Triage the queue, not a spreadsheet. Mark resources that are expected or out of scope as not affected, confirm the rest, and promote the check into a finding. Only the resources still marked affected carry over.
When your Findings Library has an approved entry for a recurring cloud issue, public buckets, a root account without MFA, SSH open to the internet, the scan issue shows the match and Promote matched issues turns a batch of them into findings in your own language. Prowler's remediation code and compliance mappings are already there for the client.
Rescan during the retest round and import the new output. Issues update in place and checks that now pass are marked fixed, so the retest shows exactly which resources were remediated.
Prowler Integration FAQ
The questions teams ask most about Prowler and Neuron.
How do I import Prowler results into a pentest report?
Import the Prowler OCSF JSON, native JSON, or CSV into the engagement, in the browser or with neuron import. Every failed check becomes a scan issue with its affected resources, remediation, and compliance mappings, ready to triage and promote into a finding.
Which Prowler output format does Neuron accept?
All three data formats Prowler writes: OCSF JSON (.ocsf.json) from current releases, the native JSON from Prowler v3, and the semicolon-delimited CSV. JSON can be a single array or one record per line. The Prowler HTML report is for reading and is not imported.
Does Neuron import passed Prowler checks?
No. Passing checks are skipped, and only failures and checks Prowler marks for manual review become scan issues. That cuts a Prowler scan of thousands of rows down to the decisions a tester actually needs to make.
Can I import Prowler scans from several cloud accounts?
Yes. Prowler issues are grouped per check and per account, so the same check failing in production and staging stays as two issues with their own resource lists. Azure subscriptions and Google Cloud projects are scoped the same way.
What happens when I import a Prowler rescan?
Existing issues are updated instead of duplicated, and checks that no longer fail are marked fixed. Run Prowler again during the retest round and the queue shows what the client remediated.
Where does Prowler data go when it is imported?
To your own self-hosted Neuron server, on the engagement it belongs to. Resource ARNs, account IDs, and tags from Prowler never pass through a third-party cloud.
More Neuron Integrations
ScoutSuite Report Import and Reporting
Cloud and MobileMobSF Report Import for Mobile Pentests
Cloud and MobileBloodHound Reporting and Attack Path Import
Active DirectoryPCAP Import: Hosts and Services From Captures
Network DiscoveryNessus Reporting and .nessus File Import
Vulnerability ScannersQualys Report Import for Pentest Reporting
Vulnerability ScannersOpenVAS Reporting and Greenbone Report Import
Vulnerability ScannersNexpose and InsightVM Report Import
Vulnerability ScannersReady to Transform Your Security Practice?
See how Neuron helps security teams replace fragmented tools with a single platform for offensive security, bringing structure, visibility, and consistency to every engagement.
Platform