Ensure container image vulnerability scanning with Defender for Containers or a third-party provider

MediaNivel 1Revisión manualaks

Descripción

Ensure vulnerability scanning is enabled for container images that are stored in registries and intended for deployment to AKS, using Microsoft Defender for Containers in Defender for Cloud or an equivalent third-party scanner. This control applies both to registry images and, where enabled and supported, to running containers in AKS. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review whether Microsoft Defender for Containers is enabled for the subscription and whether registry image vulnerability assessment is enabled under that plan. For AKS, also verify the cluster Defender profile when cluster-side monitoring is in scope, and confirm Defender for Cloud is generating vulnerability findings for relevant images. • Confirm Microsoft.Security/pricings/Containers uses pricingTier: Standard. • Confirm the ContainerRegistriesVulnerabilityAssessments extension is enabled.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enable Microsoft Defender for Containers for the subscription, enable the registry vulnerability assessment capability used for container image scanning, and then verify that Defender for Cloud is producing vulnerability findings for the registries and AKS workloads in scope. If the control is intended to cover only registry image scanning, the subscription plan and registry access settings are the key fixes; if it also includes AKS runtime protection, deploy the Defender sensor or AKS built-in integration and confirm the cluster Defender profile is enabled. 1. In the Defender for Cloud Environment settings turn Containers from Free to Standard. 2. Enable the registry image assessment capability by turning on the registry-related extension, including ContainerRegistriesVulnerabilityAssessments and required Registry access for supported registries.a 3.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aksmanaged-servicesregistry
Referencia: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.1 Ensure container image vulnerability scanning with Defender for Containers or a third-party provider