Ensure container image vulnerability scanning with Defender for Containers or a third-party provider

MittelStufe 1Manuelle Prüfungaks

Beschreibung

Ensure vulnerability scanning is enabled for container images that are stored in registries and intended for deployment to AKS, using Microsoft Defender for Containers in Defender for Cloud or an equivalent third-party scanner. This control applies both to registry images and, where enabled and supported, to running containers in AKS. The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Review whether Microsoft Defender for Containers is enabled for the subscription and whether registry image vulnerability assessment is enabled under that plan. For AKS, also verify the cluster Defender profile when cluster-side monitoring is in scope, and confirm Defender for Cloud is generating vulnerability findings for relevant images. • Confirm Microsoft.Security/pricings/Containers uses pricingTier: Standard. • Confirm the ContainerRegistriesVulnerabilityAssessments extension is enabled.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enable Microsoft Defender for Containers for the subscription, enable the registry vulnerability assessment capability used for container image scanning, and then verify that Defender for Cloud is producing vulnerability findings for the registries and AKS workloads in scope. If the control is intended to cover only registry image scanning, the subscription plan and registry access settings are the key fixes; if it also includes AKS runtime protection, deploy the Defender sensor or AKS built-in integration and confirm the cluster Defender profile is enabled. 1. In the Defender for Cloud Environment settings turn Containers from Free to Standard. 2. Enable the registry image assessment capability by turning on the registry-related extension, including ContainerRegistriesVulnerabilityAssessments and required Registry access for supported registries.a 3.

Eigenschaften

Betriebssysteme: Beliebig
Tags: aksmanaged-servicesregistry
Referenz: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.1 Ensure container image vulnerability scanning with Defender for Containers or a third-party provider