Module 23: Detect with Claude Code
Track 5 · Prowler + Claude Code · Time: ~1h · Pass: 8/10
Scenario
A new exploit is reported in the wild: attackers abuse iam:PassRole to escalate from a Lambda's role to admin. The CISO wants to know, within 30 minutes, whether Cloudsmiths is exposed. You don't write SQL. You don't tour 17 dashboards. You ask Claude Code.
Loop steps taught here: Find, Prioritize, Explain of the Agentic Cloud Defender loop from Module 22. Prowler supplies the evidence (
prowler_search_security_findings,prowler_run_attack_paths_query,prowler_get_compliance_overview); the agent explains it. Every tool call in this module works from any MCP-capable agent (Claude app, GitHub Copilot, Codex, Cursor, a custom agent), not only Claude Code; examples say "Claude Code" because that is the lab client.
Learning objectives
- Use Claude Code + Prowler MCP to detect risk by natural-language query.
- Build repeatable detection prompts you'll reuse weekly.
- Run Attack Paths queries from Claude Code.
- Cite Prowler's documentation in answers; never hallucinate.
Register to read the full module
The syllabus and each module overview are public. Create a free account to unlock the full lessons, labs, knowledge checks and the final exam, and to track your progress.