Configure Microsoft Defender for Containers components

Use the fix button from the Defender for Cloud recommendation

A streamlined, frictionless, process lets you use the Azure portal pages to enable the Defender for Cloud plan and setup auto provisioning of all the necessary components for defending your Kubernetes clusters at scale.

A dedicated Defender for Cloud recommendation provides:

• Visibility about which of your clusters has the Defender sensor deployed
• Fix button to deploy it to those clusters without the sensor

1. From Microsoft Defender for Cloud's recommendations page, open the Enable enhanced security security control.

2. Use the filter to find the recommendation named Azure Kubernetes Service clusters should have Defender profile enabled.

   Tip

   Notice the Fix icon in the actions column

3. Select the clusters to see the details of the healthy and unhealthy resources - clusters with and without the sensor.

4. From the unhealthy resources list, select a cluster and select Remediate to open the pane with the remediation confirmation.

5. Select Fix X resources.

Use the REST API to deploy the Defender sensor

To install the 'SecurityProfile' on an existing cluster with the REST API, run the following PUT command:

PUT https://management.chinacloudapi.cn/subscriptions/{{Subscription Id}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview

Request URI: https://management.chinacloudapi.cn/subscriptions/{{SubscriptionId}}/resourcegroups/{{ResourceGroup}}/providers/Microsoft.ContainerService/managedClusters/{{ClusterName}}?api-version={{ApiVersion}}

Request query parameters:

Request Body:

{
  "location": "{{Location}}",
  "properties": {
    "securityProfile": {
            "defender": {
                "logAnalyticsWorkspaceResourceId": "{{LAWorkspaceResourceId}}",
                "securityMonitoring": {
                    "enabled": true,
                }
            }
        }
    }
}

Request body parameters:

Use Azure CLI to deploy the Defender sensor

1. Sign in to Azure:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <your-subscription-id>
   

   Important

   Ensure that you use the same subscription ID for <your-subscription-id> as the one associated with your AKS cluster.

2. Enable the Defender sensor on your containers:

   • Run the following command to create a new cluster with the Defender sensor enabled:

     az aks create --enable-defender --resource-group <your-resource-group> --name <your-cluster-name>
     

   • Run the following command to enable the Defender sensor on an existing cluster:

     az aks update --enable-defender --resource-group <your-resource-group> --name <your-cluster-name>
     

   A description of all the supported configuration settings on the Defender sensor type is given below:

   Property

   Description

   logAnalyticsWorkspaceResourceId

   Optional. Full resource ID of your own Log Analytics workspace. When not provided, the default workspace of the region will be used. To get the full resource ID, run the following command to display the list of workspaces in your subscriptions in the default JSON format: az resource list --resource-type Microsoft.OperationalInsights/workspaces -o json The Log Analytics workspace resource ID has the following syntax: /subscriptions/{your-subscription-id}/resourceGroups/{your-resource-group}/providers/Microsoft.OperationalInsights/workspaces/{your-workspace-name}. Learn more in Log Analytics workspaces

   You can include these settings in a JSON file and specify the JSON file in the az aks create and az aks update commands with this parameter: --defender-config <path-to-JSON-file>. The format of the JSON file must be:

   {"logAnalyticsWorkspaceResourceId": "<workspace-id>"}
   

   Learn more about AKS CLI commands in az aks.

3. To verify that the sensor was successfully added, run the following command on your machine with the kubeconfig file pointed to your cluster:

   kubectl get pods -n kube-system
   

   When the sensor is added, you should see a pod called microsoft-defender-XXXXX in Running state. It might take a few minutes for pods to be added.

Use Azure Resource Manager to deploy the Defender sensor

To use Azure Resource Manager to deploy the Defender sensor, you'll need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

To install the 'SecurityProfile' on an existing cluster with Resource Manager:

{ 
    "type": "Microsoft.ContainerService/managedClusters", 
    "apiVersion": "2022-06-01", 
    "name": "string", 
    "location": "string",
    "properties": {
        …
        "securityProfile": { 
            "defender": { 
                "logAnalyticsWorkspaceResourceId": “logAnalyticsWorkspaceResourceId",
                "securityMonitoring": {
                    "enabled": true
                }
            }
        }
    }
}

Use the fix button from the Defender for Cloud recommendation

A dedicated Defender for Cloud recommendation provides:

• Visibility about which of your clusters has the Defender sensor deployed
• Fix button to deploy it to those clusters without the sensor

1. From Microsoft Defender for Cloud's recommendations page, open the Enable enhanced security security control.

2. Use the filter to find the recommendation named Azure Arc-enabled Kubernetes clusters should have Defender for Cloud's extension installed.

   

   Tip

   Notice the Fix icon in the actions column

3. Select the sensor to see the details of the healthy and unhealthy resources - clusters with and without the sensor.

4. From the unhealthy resources list, select a cluster and select Remediate to open the pane with the remediation options.

5. Select the relevant Log Analytics workspace and select Remediate x resource.

   

Use Azure CLI to deploy the Defender sensor

1. Sign in to Azure:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <your-subscription-id>
   

   Important

   Ensure that you use the same subscription ID for <your-subscription-id> as the one that was used when connecting your cluster to Azure Arc.

2. Run the following command to deploy the sensor on top of your Azure Arc-enabled Kubernetes cluster:

   az k8s-extension create --name microsoft.azuredefender.kubernetes --cluster-type connectedClusters --cluster-name <cluster-name> --resource-group <resource-group> --extension-type microsoft.azuredefender.kubernetes
   

   A description of all the supported configuration settings on the Defender sensor type is given below:

   Property	Description
   logAnalyticsWorkspaceResourceID	Optional. Full resource ID of your own Log Analytics workspace. When not provided, the default workspace of the region will be used. To get the full resource ID, run the following command to display the list of workspaces in your subscriptions in the default JSON format: az resource list --resource-type Microsoft.OperationalInsights/workspaces -o json The Log Analytics workspace resource ID has the following syntax: /subscriptions/{your-subscription-id}/resourceGroups/{your-resource-group}/providers/Microsoft.OperationalInsights/workspaces/{your-workspace-name}. Learn more in Log Analytics workspaces
   auditLogPath	Optional. The full path to the audit log files. When not provided, the default path /var/log/kube-apiserver/audit.log will be used. For AKS Engine, the standard path is /var/log/kubeaudit/audit.log

   The below command shows an example usage of all optional fields:

   az k8s-extension create --name microsoft.azuredefender.kubernetes --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --extension-type microsoft.azuredefender.kubernetes --configuration-settings logAnalyticsWorkspaceResourceID=<log-analytics-workspace-resource-id> auditLogPath=<your-auditlog-path>
   

Use Azure Resource Manager to deploy the Defender sensor

To use Azure Resource Manager to deploy the Defender sensor, you'll need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

You can use the azure-defender-extension-arm-template.json Resource Manager template from Defender for Cloud's installation examples.

Use REST API to deploy the Defender sensor

To use the REST API to deploy the Defender sensor, you'll need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

• To modify the Postman Collection JSON, or to manually deploy the sensor with the REST API, run the following PUT command:

  PUT https://management.chinacloudapi.cn/subscriptions/{{Subscription Id}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview
  

  Where:

  Name	In	Required	Type	Description
  Subscription ID	Path	True	String	Your Azure Arc-enabled Kubernetes resource's subscription ID
  Resource Group	Path	True	String	Name of the resource group containing your Azure Arc-enabled Kubernetes resource
  Cluster Name	Path	True	String	Name of your Azure Arc-enabled Kubernetes resource

  For Authentication, your header must have a Bearer token (as with other Azure APIs). To get a bearer token, run the following command:

  az account get-access-token --subscription <your-subscription-id> Use the following structure for the body of your message:

  { 
  "properties": { 
      "extensionType": "microsoft.azuredefender.kubernetes",
  "con    figurationSettings": { 
          "logAnalytics.workspaceId":"YOUR-WORKSPACE-ID"
      // ,    "auditLogPath":"PATH/TO/AUDITLOG"
      },
      "configurationProtectedSettings": {
          "logAnalytics.key":"YOUR-WORKSPACE-KEY"
      }
      }
  } 
  

  Description of the properties is given below:

  Property	Description
  logAnalytics.workspaceId	Workspace ID of the Log Analytics resource
  logAnalytics.key	Key of the Log Analytics resource
  auditLogPath	Optional. The full path to the audit log files. The default value is /var/log/kube-apiserver/audit.log

Use Defender for Cloud recommendation to verify the status of your sensor

1. From Microsoft Defender for Cloud's recommendations page, open the Enable Microsoft Defender for Cloud security control.

2. Select the recommendation named Azure Arc-enabled Kubernetes clusters should have Microsoft Defender for Cloud's extension installed.

   

3. Check that the cluster on which you deployed the sensor is listed as Healthy.

Use the Azure Arc pages to verify the status of your sensor

1. From the Azure portal, open Azure Arc.

2. From the infrastructure list, select Kubernetes clusters and then select the specific cluster.

3. Open the extensions page. The extensions on the cluster are listed. To confirm whether the Defender sensor was installed correctly, check the Install status column.

   

4. For more details, select the extension.

   

Use Azure CLI to verify that the sensor is deployed

1. Run the following command on Azure CLI:

   az k8s-extension show --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes
   

2. In the response, look for "extensionType": "microsoft.azuredefender.kubernetes" and "installState": "Installed".

   Note

   It might show "installState": "Pending" for the first few minutes.

3. If the state shows Installed, run the following command on your machine with the kubeconfig file pointed to your cluster to check that all pods under the mdc namespace are in the 'Running' state:

   kubectl get pods -n mdc
   

Use the REST API to verify that the sensor is deployed

To confirm a successful deployment, or to validate the status of your sensor at any time:

1. Run the following GET command:

   GET https://management.chinacloudapi.cn/subscriptions/{{Subscription Id}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview
   

2. In the response, look in "extensionType": "microsoft.azuredefender.kubernetes" for "installState": "Installed".

   Tip

   It might show "installState": "Pending" for the first few minutes.

3. If the state shows Installed, run the following command on your machine with the kubeconfig file pointed to your cluster to check that all pods under the mdc namespace are in 'Running' state:

   kubectl get pods -n mdc
   

Use Azure portal to remove the extension

1. From the Azure portal, open Azure Arc.

2. From the infrastructure list, select Kubernetes clusters and then select the specific cluster.

3. Open the extensions page. The extensions on the cluster are listed.

4. Select the cluster and select Uninstall.

   

Use Azure CLI to remove the Defender sensor

1. Remove the Microsoft Defender for Kubernetes Arc extension with the following commands:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <subscription-id>
   az k8s-extension delete --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes --yes
   

   Removing the extension might take a few minutes. We recommend you wait before you try to verify that it was successful.

2. To verify that the extension was successfully removed, run the following commands:

   az k8s-extension show --cluster-type connectedClusters --cluster-name <your-connected-cluster-name> --resource-group <your-rg> --name microsoft.azuredefender.kubernetes
   

   After that, validate that there are no pods under the mdc namespace on the cluster by running the following command with the kubeconfig file pointed to your cluster:

   kubectl get pods -n mdc
   

   It might take a few minutes for the pods to be deleted.

Use REST API to remove the Defender sensor

To remove the extension using the REST API, run the following DELETE command:

DELETE https://management.chinacloudapi.cn/subscriptions/{{Subscription Id}}/resourcegroups/{{Resource Group}}/providers/Microsoft.Kubernetes/connectedClusters/{{Cluster Name}}/providers/Microsoft.KubernetesConfiguration/extensions/microsoft.azuredefender.kubernetes?api-version=2020-07-01-preview

For Authentication, your header must have a Bearer token (as with other Azure APIs). To get a bearer token, run the following command:

az account get-access-token --subscription <your-subscription-id>

The request might take several minutes to complete.

Use REST API to remove the Defender sensor from AKS

To remove the extension using the REST API, run the following PUT command:

https://management.chinacloudapi.cn/subscriptions/{{SubscriptionId}}/resourcegroups/{{ResourceGroup}}/providers/Microsoft.ContainerService/managedClusters/{{ClusterName}}?api-version={{ApiVersion}}

Request body:

{
  "location": "{{Location}}",
  "properties": {
    "securityProfile": {
            "defender": {
                "securityMonitoring": {
                    "enabled": false
                }
            }
        }
    }
}

Request body parameters:

Use Azure CLI to remove the Defender sensor

1. Remove the Microsoft Defender for with the following commands:

   az cloud set -n AzureChinaCloud
   az login
   az account set --subscription <subscription-id>
   az aks update --disable-defender --resource-group <your-resource-group> --name <your-cluster-name>
   

   Removing the extension might take a few minutes.

2. To verify that the extension was successfully removed, run the following command:

   kubectl get pods -n kube-system | grep microsoft-defender
   

   When the extension is removed, you should see that no pods are returned in the get pods command. It might take a few minutes for the pods to be deleted.

Use Azure Resource Manager to remove the Defender sensor from AKS

To use Azure Resource Manager to remove the Defender sensor, you'll need a Log Analytics workspace on your subscription. Learn more in Log Analytics workspaces.

The relevant template and parameters to remove the Defender sensor from AKS are:

{ 
    "type": "Microsoft.ContainerService/managedClusters", 
    "apiVersion": "2022-06-01", 
    "name": "string", 
    "location": "string",
    "properties": {
        …
        "securityProfile": { 
            "defender": { 
                "securityMonitoring": {
                    "enabled": false
                }
            }
        }
    }
}