Vulnerability assessments for AWS with Microsoft Defender Vulnerability Management
Vulnerability assessment for AWS, powered by Microsoft Defender Vulnerability Management, is an out-of-box solution that empowers security teams to easily discover and remediate vulnerabilities in Linux container images, with zero configuration for onboarding, and without deployment of any sensors.
Note
This feature supports scanning of images in the ECR only. Images that are stored in other container registries should be imported into ECR for coverage. Learn how to import container images to a container registry.
In every account where enablement of this capability is completed, all images stored in ECR that meet the criteria for scan triggers are scanned for vulnerabilities without any extra configuration of users or registries. Recommendations with vulnerability reports are provided for all images in ECR as well as images that are currently running in EKS that were pulled from an ECR registry or any other Defender for Cloud supported registry (ACR, GCR, or GAR). Images are scanned shortly after being added to a registry, and re-scanned for new vulnerabilities at the interval set in the AWS connector.
Container vulnerability assessment powered by Microsoft Defender Vulnerability Management has the following capabilities:
Scanning OS packages - container vulnerability assessment has the ability to scan vulnerabilities in packages installed by the OS package manager in Linux and Windows operating systems. See the full list of the supported OS and their versions.
Language specific packages – Linux only - support for language specific packages and files, and their dependencies installed or copied without the OS package manager. See the complete list of supported languages.
Exploitability information - Each vulnerability report is searched through exploitability databases to assist our customers with determining actual risk associated with each reported vulnerability.
Reporting - Container Vulnerability Assessment for AWS powered by Microsoft Defender Vulnerability Management provides vulnerability reports using following recommendations:
These are the new preview recommendations that report on runtime container vulnerabilities and registry image vulnerabilities. These new recommendations do not count toward secure score while in preview. The scan engine for those new recommendations is the same as the current GA recommendations, and provides the same findings. These recommendations would be best suited for customers that use the new risk-based view for recommendations and have the Defender CSPM plan enabled.
| Recommendation | Description | Assessment Key |
|---|---|---|
| [Preview] Container images in AWS registry should have vulnerability findings resolved | Defender for Cloud scans your registry images for known vulnerabilities (CVEs) and provides detailed findings for each scanned image. Scanning and remediating vulnerabilities for container images in the registry helps maintain a secure and reliable software supply chain, reduces the risk of security incidents, and ensures compliance with industry standards. | 2a139383-ec7e-462a-90ac-b1b60e87d576 |
| [Preview] Containers running in AWS should have vulnerability findings resolved | Defender for Cloud creates an inventory of all container workloads currently running in your Kubernetes clusters and provides vulnerability reports for those workloads by matching the images being used and the vulnerability reports created for the registry images. Scanning and remediating vulnerabilities of container workloads is critical to ensure a robust and secure software supply chain, reduce the risk of security incidents, and ensures compliance with industry standards. | 8749bb43-cd24-4cf9-848c-2a50f632043c |
These current GA recommendations report on vulnerabilities in containers contained within a Kubernetes cluster, and on container images contained within a container registry. These recommendations would be best suited for customers that use the classic view for recommendations and do not have Defender CSPM plan enabled.
| Recommendation | Description | Assessment Key |
|---|---|---|
| AWS registry container images should have vulnerability findings resolved (powered by Microsoft Defender Vulnerability Management) | Scans your AWS registries container images for commonly known vulnerabilities (CVEs) and provides a detailed vulnerability report for each image. Resolving vulnerabilities can greatly improve your security posture, ensuring images are safe to use prior to deployment. | c27441ae-775c-45be-8ffa-655de37362ce |
| AWS running container images should have vulnerability findings resolved (powered by Microsoft Defender Vulnerability Management) | Container image vulnerability assessment scans your registry for commonly known vulnerabilities (CVEs) and provides a detailed vulnerability report for each image. This recommendation provides visibility to vulnerable images currently running in your Elastic Kubernetes clusters. Remediating vulnerabilities in container images that are currently running is key to improving your security posture, significantly reducing the attack surface for your containerized workloads. | 682b2595-d045-4cff-b5aa-46624eb2dd8f |
Query vulnerability information via the Azure Resource Graph - Ability to query vulnerability information via the Azure Resource Graph. Learn how to query recommendations via ARG.
Query scan results via REST API - Learn how to query scan results via REST API.
Scan triggers
The triggers for an image scan are:
One-time triggering:
- Each image pushed to a container registry is triggered to be scanned. In most cases, the scan is completed within a few hours, but in rare cases it might take up to 24 hours.
- Each image pulled from a registry is triggered to be scanned within 24 hours.
Continuous rescan triggering – continuous rescan is required to ensure images that have been previously scanned for vulnerabilities are rescanned to update their vulnerability reports in case a new vulnerability is published.
- Re-scan is performed once a day for:
- Images pushed in the last 90 days.
- Images pulled in the last 30 days.
- Images currently running on the Kubernetes clusters monitored by Defender for Cloud (either via Agentless discovery for Kubernetes or the Defender sensor).
- Re-scan is performed once a day for:
How does image scanning work?
A detailed description of the scan process is described as follows:
When you enable the container vulnerability assessment for AWS powered by Microsoft Defender Vulnerability Management, you authorize Defender for Cloud to scan container images in your Elastic Container registries.
Defender for Cloud automatically discovers all containers registries, repositories and images (created before or after enabling this capability).
Once a day, and for new images pushed to a registry:
- All newly discovered images are pulled, and an inventory is created for each image. Image inventory is kept to avoid further image pulls, unless required by new scanner capabilities.
- Using the inventory, vulnerability reports are generated for new images, and updated for images previously scanned which were either pushed in the last 90 days to a registry, or are currently running. To determine if an image is currently running, Defender for Cloud uses both Agentless discovery for Kubernetes and inventory collected via the Defender sensor running on EKS nodes
- Vulnerability reports for registry container images are provided as a recommendation.
For customers using either Agentless discovery for Kubernetes or inventory collected via the Defender sensor running on EKS nodes, Defender for Cloud also creates a recommendation for remediating vulnerabilities for vulnerable images running on an EKS cluster. For customers using only Agentless discovery for Kubernetes, the refresh time for inventory in this recommendation is once every seven hours. Clusters that are also running the Defender sensor benefit from a two hour inventory refresh rate. Image scan results are updated based on registry scan in both cases, and are therefore only refreshed every 24 hours.
Note
For Defender for Container Registries (deprecated), images are scanned once on push, on pull, and rescanned only once a week.
If I remove an image from my registry, how long before vulnerabilities reports on that image would be removed?
It takes 30 hours after an image is deleted from ECR before the reports are removed.
Next steps
- Learn more about the Defender for Cloud Defender plans.
- Check out common questions about Defender for Containers.