Ensure container image vulnerability scanning with Defender for Containers or a third-party provider

Trung bìnhCấp 1Xem xét thủ côngaks

Mô tả

Ensure vulnerability scanning is enabled for container images that are stored in registries and intended for deployment to AKS, using Microsoft Defender for Containers in Defender for Cloud or an equivalent third-party scanner. This control applies both to registry images and, where enabled and supported, to running containers in AKS. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Review whether Microsoft Defender for Containers is enabled for the subscription and whether registry image vulnerability assessment is enabled under that plan. For AKS, also verify the cluster Defender profile when cluster-side monitoring is in scope, and confirm Defender for Cloud is generating vulnerability findings for relevant images. • Confirm Microsoft.Security/pricings/Containers uses pricingTier: Standard. • Confirm the ContainerRegistriesVulnerabilityAssessments extension is enabled.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Enable Microsoft Defender for Containers for the subscription, enable the registry vulnerability assessment capability used for container image scanning, and then verify that Defender for Cloud is producing vulnerability findings for the registries and AKS workloads in scope. If the control is intended to cover only registry image scanning, the subscription plan and registry access settings are the key fixes; if it also includes AKS runtime protection, deploy the Defender sensor or AKS built-in integration and confirm the cluster Defender profile is enabled. 1. In the Defender for Cloud Environment settings turn Containers from Free to Standard. 2. Enable the registry image assessment capability by turning on the registry-related extension, including ContainerRegistriesVulnerabilityAssessments and required Registry access for supported registries.a 3.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: aksmanaged-servicesregistry
Tham chiếu: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.1 Ensure container image vulnerability scanning with Defender for Containers or a third-party provider