Ensure container image vulnerability scanning with Defender for Containers or a third-party provider

SedangLevel 1Tinjauan manualaks

Deskripsi

Ensure vulnerability scanning is enabled for container images that are stored in registries and intended for deployment to AKS, using Microsoft Defender for Containers in Defender for Cloud or an equivalent third-party scanner. This control applies both to registry images and, where enabled and supported, to running containers in AKS. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review whether Microsoft Defender for Containers is enabled for the subscription and whether registry image vulnerability assessment is enabled under that plan. For AKS, also verify the cluster Defender profile when cluster-side monitoring is in scope, and confirm Defender for Cloud is generating vulnerability findings for relevant images. • Confirm Microsoft.Security/pricings/Containers uses pricingTier: Standard. • Confirm the ContainerRegistriesVulnerabilityAssessments extension is enabled.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Enable Microsoft Defender for Containers for the subscription, enable the registry vulnerability assessment capability used for container image scanning, and then verify that Defender for Cloud is producing vulnerability findings for the registries and AKS workloads in scope. If the control is intended to cover only registry image scanning, the subscription plan and registry access settings are the key fixes; if it also includes AKS runtime protection, deploy the Defender sensor or AKS built-in integration and confirm the cluster Defender profile is enabled. 1. In the Defender for Cloud Environment settings turn Containers from Free to Standard. 2. Enable the registry image assessment capability by turning on the registry-related extension, including ContainerRegistriesVulnerabilityAssessments and required Registry access for supported registries.a 3.

Properti

Sistem operasi: Apa saja
Tag: aksmanaged-servicesregistry
Referensi: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.1 Ensure container image vulnerability scanning with Defender for Containers or a third-party provider