Common questions about protecting containers

You can use the Azure Policy Configure Microsoft Defender for Containers to be enabled, to enable Defender for Containers at scale. You can also see all of the options that are available to enable Microsoft Defender for Containers.

Yes.

No. Only Azure Kubernetes Service (AKS) clusters that use Virtual Machine Scale Sets for the nodes is supported.

No, AKS is a managed service, and manipulation of the IaaS resources isn't supported. The Log Analytics VM extension isn't needed and might result in extra charges.

You can use your existing Log Analytics workspace by following the steps in the Assign a custom workspace workspace section of this article.

We don't recommend deleting the default workspace. Defender for Containers uses the default workspaces to collect security data from your clusters. Defender for Containers will be unable to collect data, and some security recommendations and alerts, will become unavailable if you delete the default workspace.

To recover your default workspace, you need to remove the Defender sensor, and reinstall the sensor. Reinstalling the Defender sensor creates a new default workspace.

Depending on your region, the default Log Analytics workspace might be located in various locations. To check your region see Where is the default Log Analytics workspace created?

The Defender sensor uses the Log analytics workspace to send data from your Kubernetes clusters to Defender for Cloud. The Defender for Cloud adds the Log analytic workspace and the resource group as a parameter for the sensor to use.

However, if your organization has a policy that requires a specific tag on your resources, it might cause the sensor installation to fail during the resource group or the default workspace creation stage. If it fails, you can either:

• Assign a custom workspace and add any tag your organization requires.

  or

• If your company requires you to tag your resource, you should navigate to that policy and exclude the following resources:

  1. The resource group DefaultResourceGroup-<RegionShortCode>
  2. The Workspace DefaultWorkspace-<sub-id>-<RegionShortCode>

  RegionShortCode is a 2-4 letters string.

Defender for Containers pulls the image from the registry and runs it in an isolated sandbox with Microsoft Defender Vulnerability Management for Azure environments. The scanner extracts a list of known vulnerabilities.

Defender for Cloud filters and classifies findings from the scanner. When an image is healthy, Defender for Cloud marks it as such. Defender for Cloud generates security recommendations only for images that have issues to be resolved. By only notifying you when there are problems, Defender for Cloud reduces the potential for unwanted informational alerts.

To identify pull events performed by the scanner, do the following steps:

1. Search for pull events with the UserAgent of AzureContainerImageScanner.
2. Extract the identity associated with this event.
3. Use the extracted identity to identify pull events from the scanner.

• Not applicable resources are resources for which the recommendation can't give a definitive answer. The not applicable tab includes reasons for each resource that couldn't be assessed.
• Unverified resources are resources scheduled to be assessed, but not assessed yet.

Some images might reuse tags from an image that was already scanned. For example, you might reassign the tag “Latest” every time you add an image to a digest. In such cases, the 'old' image does still exist in the registry and might still be pulled by its digest. If the image has security findings and is pulled, it will expose security vulnerabilities.

Currently, Defender for Containers can scan images in Azure Container Registry (ACR) only. Docker Registry, Microsoft Artifact Registry/Microsoft Container Registry, and Azure Red Hat OpenShift (ARO) built-in container image registry aren't supported. Images should first be imported to ACR. Learn more about importing container images to an Azure container registry.

Yes. The results are under Sub-Assessments REST API. Also, you can use Azure Resource Graph (ARG), the Kusto-like API for all of your resources: a query can fetch a specific scan.

To check an image type, you need to use a tool that can check the raw image manifest such as skopeo, and inspect the raw image format.

• For the Docker v2 format, the manifest media type would be application/vnd.docker.distribution.manifest.v1+json or application/vnd.docker.distribution.manifest.v2+json, as documented here.
• For the OCI image format, the manifest media type would be application/vnd.oci.image.manifest.v1+json, and config media type application/vnd.oci.image.config.v1+json, as documented here.

There are two extensions that provide agentless CSPM functionality:

• Agentless Container vulnerability assessments: Provides agentless containers vulnerability assessments.
• Agentless discovery for Kubernetes: Provides API-based discovery of information about Kubernetes cluster architecture, workload objects, and setup.

To onboard multiple subscriptions at once, you can use this script.

If you don't see results from your clusters, check the following questions:

• Do you have stopped clusters?
• Are your resource groups, subscriptions, or clusters locked? If the answer to either of these questions is yes, see the answers in the following questions.

We don't support or charge stopped clusters. To get the value of agentless capabilities on a stopped cluster, you can rerun the cluster.

We suggest that you unlock the locked resource group/subscription/cluster, make the relevant requests manually, and then relock the resource group/subscription/cluster by doing the following:

1. Enable the feature flag manually via CLI by using Trusted Access.

   “az feature register --namespace "Microsoft.ContainerService" --name "TrustedAccessPreview” 
   

2. Perform the bind operation in the CLI:

   az account set -s <SubscriptionId> 
   az extension add --name aks-preview 
   az aks trustedaccess rolebinding create --resource-group <cluster resource group> --cluster-name <cluster name> --name defender-cloudposture --source-resource-id /subscriptions/<SubscriptionId>/providers/Microsoft.Security/pricings/CloudPosture/securityOperators/DefenderCSPMSecurityOperator --roles  "Microsoft.Security/pricings/microsoft-defender-operator" 
   

For locked clusters, you can also do one of the following steps:

• Remove the lock.
• Perform the bind operation manually by making an API request. Learn more about locked resources.

Learn more about supported Kubernetes versions in Azure Kubernetes Service (AKS).

It can take up to 24 hours for changes to reflect in the security graph, attack paths, and the security explorer.

Next steps

Learn about Defender for Containers