Configure Microsoft Defender for Containers components

Use the Fix button from the Defender for Cloud recommendation

You can use Azure portal pages to enable the Defender for Cloud plan and set up automatic provisioning of all the necessary components for defending your Kubernetes clusters at scale. The process is streamlined.

A dedicated Defender for Cloud recommendation provides:

• Visibility into which of your clusters has the Defender sensor deployed.
• A Fix button to deploy the sensor to clusters that don't have it.

To deploy the sensor:

1. On the Microsoft Defender for Cloud Recommendations page, open the Enable enhanced security security control.

2. Use the filter to find the recommendation named Azure Kubernetes Service clusters should have Defender profile enabled.

   Tip

   Notice the Fix icon in the Actions column.

3. Select the clusters to see the details of the healthy and unhealthy resources (clusters with and without the sensor).

4. In the list of unhealthy resources, select a cluster. Then select Remediate to open the pane with the remediation confirmation.

5. Select Fix X resources.

Use the REST API to deploy the Defender sensor

To install securityProfile on an existing cluster by using the REST API, run the following PUT command:

PUT https://management.chinacloudapi.cn/subscriptions/{{Subscription ID}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview

Here's the request URI:

https://management.chinacloudapi.cn/subscriptions/{{SubscriptionId}}/resourcegroups/{{ResourceGroup}}/providers/Microsoft.ContainerService/managedClusters/{{ClusterName}}?api-version={{ApiVersion}}

The request query has these parameters:

This is the request body:

{
  "location": "{{Location}}",
  "properties": {
    "securityProfile": {
            "defender": {
                "logAnalyticsWorkspaceResourceId": "{{LAWorkspaceResourceId}}",
                "securityMonitoring": {
                    "enabled": true,
                }
            }
        }
    }
}

The request body has these parameters:

Use the Azure CLI to deploy the Defender sensor

1. Sign in to Azure:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <your-subscription-id>
   

   Important

   Ensure that you use the same subscription ID for <your-subscription-id> as the one that's associated with your AKS cluster.

2. Enable the Defender sensor on your containers:

   • Run the following command to create a new cluster with the Defender sensor enabled:

     az aks create --enable-defender --resource-group <your-resource-group> --name <your-cluster-name>
     

   • Run the following command to enable the Defender sensor on an existing cluster:

     az aks update --enable-defender --resource-group <your-resource-group> --name <your-cluster-name>
     

   Here are the supported configuration settings on the Defender sensor type:

   Property

   Description

   logAnalyticsWorkspaceResourceId

   Optional. Full resource ID of your own Log Analytics workspace. If you don't provide one, the default workspace of the region is used. To get the full resource ID, run the following command to display the list of workspaces in your subscriptions in the default JSON format: az resource list --resource-type Microsoft.OperationalInsights/workspaces -o json The Log Analytics workspace's resource ID has the following syntax: /subscriptions/{your-subscription-id}/resourceGroups/{your-resource-group}/providers/Microsoft.OperationalInsights/workspaces/{your-workspace-name} Learn more in Log Analytics workspaces.

   You can include these settings in a JSON file and specify the JSON file in the az aks create and az aks update commands with this parameter: --defender-config <path-to-JSON-file>. The format of the JSON file must be:

   {"logAnalyticsWorkspaceResourceId": "<workspace-id>"}
   

   Learn more about AKS CLI commands in az aks.

3. To verify that the sensor was successfully added, run the following command on your machine with the kubeconfig file pointed to your cluster:

   kubectl get pods -n kube-system
   

   When the sensor is added, you should see a pod called microsoft-defender-XXXXX in the Running state. It might take a few minutes for pods to be added.

Use Azure Resource Manager to deploy the Defender sensor

To use Azure Resource Manager to deploy the Defender sensor, you need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

To install securityProfile on an existing cluster by using Resource Manager:

{ 
    "type": "Microsoft.ContainerService/managedClusters", 
    "apiVersion": "2022-06-01", 
    "name": "string", 
    "location": "string",
    "properties": {
        …
        "securityProfile": { 
            "defender": { 
                "logAnalyticsWorkspaceResourceId": "logAnalyticsWorkspaceResourceId",
                "securityMonitoring": {
                    "enabled": true
                }
            }
        }
    }
}

Use the Fix button from the Defender for Cloud recommendation

A dedicated Defender for Cloud recommendation provides:

• Visibility into which of your clusters has the Defender sensor deployed.
• A Fix button to deploy the sensor to clusters that don't have it.

To deploy the sensor:

1. On the Microsoft Defender for Cloud Recommendations page, open the Enable enhanced security security control.

2. Use the filter to find the recommendation named Azure Arc-enabled Kubernetes clusters should have Microsoft Defender's extension enabled.

   

   Tip

   Notice the Fix icon in the Actions column.

3. Select the sensor to see the details of the healthy and unhealthy resources (clusters with and without the sensor).

4. In the list of unhealthy resources, select a cluster. Then select Remediate to open the pane with the remediation options.

5. Select the relevant Log Analytics workspace, and then select Remediate x resource.

   

Use the Azure CLI to deploy the Defender sensor

1. Sign in to Azure:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <your-subscription-id>
   

   Important

   Ensure that you use the same subscription ID for <your-subscription-id> as the one that you used when connecting your cluster to Azure Arc.

2. Run the following command to deploy the sensor on top of your Azure Arc-enabled Kubernetes cluster:

   az k8s-extension create --name microsoft.azuredefender.kubernetes --cluster-type connectedClusters --cluster-name <cluster-name> --resource-group <resource-group> --extension-type microsoft.azuredefender.kubernetes
   

   Here are the supported configuration settings on the Defender sensor type:

   Property	Description
   logAnalyticsWorkspaceResourceID	Optional. Full resource ID of your own Log Analytics workspace. If you don't provide one, the default workspace of the region is used. To get the full resource ID, run the following command to display the list of workspaces in your subscriptions in the default JSON format: az resource list --resource-type Microsoft.OperationalInsights/workspaces -o json The Log Analytics workspace resource ID has the following syntax: /subscriptions/{your-subscription-id}/resourceGroups/{your-resource-group}/providers/Microsoft.OperationalInsights/workspaces/{your-workspace-name} Learn more in Log Analytics workspaces.
   auditLogPath	Optional. Full path to the audit log files. If you don't provide one, the default path /var/log/kube-apiserver/audit.log is used. For AKS Engine, the standard path is /var/log/kubeaudit/audit.log.

   The following command shows an example usage of all optional fields:

   az k8s-extension create --name microsoft.azuredefender.kubernetes --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --extension-type microsoft.azuredefender.kubernetes --configuration-settings logAnalyticsWorkspaceResourceID=<log-analytics-workspace-resource-id> auditLogPath=<your-auditlog-path>
   

Use Azure Resource Manager to deploy the Defender sensor

To use Azure Resource Manager to deploy the Defender sensor, you need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

You can use the azure-defender-extension-arm-template.json Resource Manager template from the Defender for Cloud installation examples.

Use the REST API to deploy the Defender sensor

To use the REST API to deploy the Defender sensor, you need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

To manually deploy the sensor by using the REST API, run the following PUT command:

PUT https://management.chinacloudapi.cn/subscriptions/{{Subscription ID}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview

The command includes these parameters:

For Authentication, your header must have a bearer token (as with other Azure APIs). To get a bearer token, run the following command:

az account get-access-token --subscription <your-subscription-id>

Use the following structure for the body of your message:

{ 
"properties": { 
    "extensionType": "microsoft.azuredefender.kubernetes",
"con    figurationSettings": { 
        "logAnalytics.workspaceId":"YOUR-WORKSPACE-ID"
    // ,    "auditLogPath":"PATH/TO/AUDITLOG"
    },
    "configurationProtectedSettings": {
        "logAnalytics.key":"YOUR-WORKSPACE-KEY"
    }
    }
} 

The message body includes these properties:

Use Defender for Cloud recommendations to verify the status of your sensor

1. On the Microsoft Defender for Cloud Recommendations page, open the Enable Microsoft Defender for Cloud security control.

2. Select the recommendation named Azure Arc-enabled Kubernetes clusters should have Microsoft Defender's extension enabled.

   

3. Check that the cluster on which you deployed the sensor is listed as Healthy.

Use the Azure Arc pages to verify the status of your sensor

1. In the Azure portal, open Azure Arc.

2. In the infrastructure list, select Kubernetes clusters, and then select the specific cluster.

3. Open the Extensions page. The page lists the extensions on the cluster. To confirm whether the Defender sensor was installed correctly, check the Install status column.

   

4. For more details, select the extension.

   

Use the Azure CLI to verify that the sensor is deployed

1. Run the following command in the Azure CLI:

   az k8s-extension show --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes
   

2. In the response, look for "extensionType": "microsoft.azuredefender.kubernetes" and "installState": "Installed".

   Note

   The response might show "installState": "Pending" for the first few minutes.

3. If the state shows Installed, run the following command on your machine with the kubeconfig file pointed to your cluster. Then check that all pods under the mdc namespace are in the Running state.

   kubectl get pods -n mdc
   

Use the REST API to verify that the sensor is deployed

To confirm a successful deployment, or to validate the status of your sensor at any time:

1. Run the following GET command:

   GET https://management.chinacloudapi.cn/subscriptions/{{Subscription ID}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview
   

2. In the response, look in "extensionType": "microsoft.azuredefender.kubernetes" for "installState": "Installed".

   Tip

   The response might show "installState": "Pending" for the first few minutes.

3. If the state shows Installed, run the following command on your machine with the kubeconfig file pointed to your cluster. Then check that all pods under the mdc namespace are in the Running state.

   kubectl get pods -n mdc
   

Use the Azure portal to remove the extension

1. In the Azure portal, open Azure Arc.

2. In the infrastructure list, select Kubernetes clusters, and then select the specific cluster.

3. Open the Extensions page, which lists extensions on the cluster.

4. Select the extension, and then select Uninstall.

   

Use the Azure CLI to remove the Defender sensor

1. Remove the Azure Arc extension for Microsoft Defender for Kubernetes by using the following commands:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <subscription-id>
   az k8s-extension delete --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes --yes
   

   Removing the extension might take a few minutes. We recommend that you wait before you try to verify that it was successful.

2. To verify that you successfully removed the extension, run the following commands:

   az k8s-extension show --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes
   

3. Validate that there are no pods under the mdc namespace on the cluster. Run the following command with the kubeconfig file pointed to your cluster:

   kubectl get pods -n mdc
   

   Deletion of the pods might take a few minutes.

Use the REST API to remove the Defender sensor

To remove the extension by using the REST API, run the following DELETE command:

DELETE https://management.chinacloudapi.cn/subscriptions/{{Subscription ID}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview

The command includes these parameters:

For Authentication, your header must have a bearer token (as with other Azure APIs). To get a bearer token, run the following command:

az account get-access-token --subscription <your-subscription-id>

The request might take several minutes to complete.

Use the REST API to remove the Defender sensor from AKS

To remove the extension by using the REST API, run the following PUT command:

https://management.chinacloudapi.cn/subscriptions/{{SubscriptionId}}/resourcegroups/{{ResourceGroup}}/providers/Microsoft.ContainerService/managedClusters/{{ClusterName}}?api-version={{ApiVersion}}

The command includes these parameters:

This is the request body:

{
  "location": "{{Location}}",
  "properties": {
    "securityProfile": {
            "defender": {
                "securityMonitoring": {
                    "enabled": false
                }
            }
        }
    }
}

The request body has these parameters:

Use the Azure CLI to remove the Defender sensor

1. Run the following commands:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <subscription-id>
   az aks update --disable-defender --resource-group <your-resource-group> --name <your-cluster-name>
   

   Removing the extension might take a few minutes.

2. To verify that you successfully removed the extension, run the following command:

   kubectl get pods -n kube-system | grep microsoft-defender
   

   When the extension is removed, the get pods command doesn't return any pods. Deletion of the pods might take a few minutes.

Use Azure Resource Manager to remove the Defender sensor from AKS

To use Azure Resource Manager to remove the Defender sensor, you need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

The relevant template and parameters to remove the Defender sensor from AKS are:

{ 
    "type": "Microsoft.ContainerService/managedClusters", 
    "apiVersion": "2022-06-01", 
    "name": "string", 
    "location": "string",
    "properties": {
        …
        "securityProfile": { 
            "defender": { 
                "securityMonitoring": {
                    "enabled": false
                }
            }
        }
    }
}