Vulnerability assessments for Azure with Microsoft Defender Vulnerability Management

Vulnerability assessment for Azure, powered by Microsoft Defender Vulnerability Management, is an out-of-box solution that empowers security teams to easily discover and remediate vulnerabilities in container images, with zero configuration for onboarding, and without deployment of any agents.

In every subscription where this capability is enabled, all images stored in ACR that meet the criteria for scan triggers are scanned for vulnerabilities without any extra configuration of users or registries. Recommendations with vulnerability reports are provided for all images in ACR as well as images that are currently running in AKS that were pulled from an ACR registry. Images are scanned shortly after being added to a registry, and rescanned for new vulnerabilities once every 24 hours.

Container vulnerability assessment powered by Microsoft Defender Vulnerability Management has the following capabilities:

• Scanning OS packages - container vulnerability assessment has the ability to scan vulnerabilities in packages installed by the OS package manager in Linux and Windows OS. See the full list of the supported OS and their versions.
• Language specific packages - Linux only - support for language specific packages and files, and their dependencies installed or copied without the OS package manager. See the complete list of supported languages.
• Image scanning in Azure Private Link - Azure container vulnerability assessment provides the ability to scan images in container registries that are accessible via Azure Private Links. This capability requires access to trusted services and authentication with the registry. Learn how to allow access by trusted services.
• Exploitability information - Each vulnerability report is searched through exploitability databases to assist our customers with determining actual risk associated with each reported vulnerability.
• Reporting - Container Vulnerability Assessment for Azure powered by Microsoft Defender Vulnerability Management provides vulnerability reports using following recommendations:

• Query vulnerability information via the Azure Resource Graph - Ability to query vulnerability information via the Azure Resource Graph. Learn how to query recommendations via ARG.
• Query scan results via REST API - Learn how to query scan results via REST API.

Scan triggers

The triggers for an image scan are:

• One-time triggering:

  • Each image pushed or imported to a container registry is triggered to be scanned. In most cases, the scan is completed within a few minutes, but in rare cases it might take up to an hour.
  • Each image pulled from a registry is triggered to be scanned within 24 hours.

• Continuous rescan triggering - continuous rescan is required to ensure images that have been previously scanned for vulnerabilities are rescanned to update their vulnerability reports in case a new vulnerability is published.

  • Re-scan is performed once a day for:
    • Images pushed in the last 90 days.
    • Images pulled in the last 30 days.
    • Images currently running on the Kubernetes clusters monitored by Defender for Cloud (either via Agentless discovery for Kubernetes or the Defender sensor).

How does image scanning work?

A detailed description of the scan process is described as follows:

• When you enable the container vulnerability assessment for Azure powered by Microsoft Defender Vulnerability Management, you authorize Defender for Cloud to scan container images in your Azure Container registries.

• Defender for Cloud automatically discovers all containers registries, repositories and images (created before or after enabling this capability).

• Defender for Cloud receives notifications whenever a new image is pushed to an Azure Container Registry. The new image is then immediately added to the catalog of images Defender for Cloud maintains, and queues an action to scan the image immediately.

• Once a day, and for new images pushed to a registry:

  • All newly discovered images are pulled, and an inventory is created for each image. Image inventory is kept to avoid further image pulls, unless required by new scanner capabilities.​
  • Using the inventory, vulnerability reports are generated for new images, and updated for images previously scanned which were either pushed in the last 90 days to a registry, or are currently running. To determine if an image is currently running, Defender for Cloud uses both Agentless discovery for Kubernetes and inventory collected via the Defender sensor running on AKS nodes
  • Vulnerability reports for registry container images are provided as a recommendation.

• For customers using either Agentless discovery for Kubernetes or inventory collected via the Defender sensor running on AKS nodes, Defender for Cloud also creates a recommendation for remediating vulnerabilities for vulnerable images running on an AKS cluster. For customers using only Agentless discovery for Kubernetes, the refresh time for inventory in this recommendation is once every seven hours. Clusters that are also running the Defender sensor benefit from a two hour inventory refresh rate. Image scan results are updated based on registry scan in both cases, and are therefore only refreshed every 24 hours.

If I remove an image from my registry, how long before vulnerabilities reports on that image would be removed?

Azure Container Registries notifies Defender for Cloud when images are deleted, and removes the vulnerability assessment for deleted images within one hour. In some rare cases, Defender for Cloud might not be notified on the deletion, and deletion of associated vulnerabilities in such cases might take up to three days.

Next steps

• Learn more about the Defender for Cloud Defender plans.
• Check out common questions about Defender for Containers.