Container protection in Defender for Cloud
Microsoft Defender for Containers is a cloud-native solution to improve, monitor, and maintain the security of your containerized assets (Kubernetes clusters, Kubernetes nodes, Kubernetes workloads, container registries, container images and more), and their applications, across multicloud and on-premises environments.
Defender for Containers assists you with four core domains of container security:
Security posture management runs continuous monitoring of cloud APIs, Kubernetes APIs, and Kubernetes workloads to discover cloud resources, provide comprehensive inventory capabilities, detect misconfigurations with mitigation guidelines, provide contextual risk assessment, and empowers users to perform enhanced risk hunting capabilities through the Defender for Cloud security explorer.
Vulnerability assessment - performs agentless vulnerability assessment of supported K8s nodes and container registries with remediation guidelines, zero configuration, daily re-scans, coverage for OS and language packages, and exploitability insights.
Run-time threat protection - a rich threat detection suite for Kubernetes clusters, nodes, and workloads, powered by Microsoft leading threat intelligence, provides mapping to MITRE ATT&CK framework for easy understanding of risk and relevant context, and automated response. Security operators can also investigate and respond to threats to Kubernetes services through the Microsoft Defender XDR portal.
Deployment & monitoring- Monitors your Kubernetes clusters for missing sensors and provides frictionless at-scale deployment for sensor-based capabilities, support for standard Kubernetes monitoring tools, and management of unmonitored resources.
You can learn more by watching this video from the Defender for Cloud in the Field video series: Microsoft Defender for Containers.
Microsoft Defender for Containers plan availability
| Aspect | Details |
|---|---|
| Release state: | General availability (GA) Certain features are in preview. For a full list, see the Containers support matrix in Defender for Cloud |
| Feature availability | Refer to the Containers support matrix in Defender for Cloud for additional information on feature release state and availability |
| Pricing: | Microsoft Defender for Containers is billed as shown on the pricing page |
| Required roles and permissions: | * To deploy the required components, see the permissions for each of the components * Security admin can dismiss alerts * Security reader can view vulnerability assessment findings See also Roles for remediation and Azure Container Registry roles and permissions |
| Clouds: | View the Containers support matrix in Defender for Cloud to see cloud availability |
Security posture management
Agentless capabilities
Agentless discovery for Kubernetes - provides zero footprint, API-based discovery of your Kubernetes clusters, configurations, and deployments.
Agentless vulnerability assessment - provides vulnerability assessment for cluster nodes and for all container images, including recommendations for registry and runtime, quick scans of new images, daily refresh of results, exploitability insights, and more. Vulnerability information is added to the security graph for contextual risk assessment and calculation of attack paths, and hunting capabilities.
Comprehensive inventory capabilities - enables you to explore resources, pods, services, repositories, images, and configurations through security explorer to easily monitor and manage your assets.
Enhanced risk-hunting - enables security admins to actively hunt for posture issues in their containerized assets through queries (built-in and custom) and security insights in the security explorer
Control plane hardening - continuously assesses the configurations of your clusters and compares them with the initiatives applied to your subscriptions. When it finds misconfigurations, Defender for Cloud generates security recommendations that are available on Defender for Cloud's Recommendations page. The recommendations let you investigate and remediate issues.
You can use the resource filter to review the outstanding recommendations for your container-related resources, whether in asset inventory or the recommendations page:
For details included with this capability, review container recommendations, and look for recommendations with type "Control plane"
Sensor-based capabilities
Binary drift detection - Defender for Containers provides a sensor-based capability that alerts you about potential security threats by detecting unauthorized external processes within containers. You can define drift policies to specify conditions under which alerts should be generated, helping you distinguish between legitimate activities and potential threats. For more information, see Binary drift protection (preview).
Kubernetes data plane hardening - To protect the workloads of your Kubernetes containers with best practice recommendations, you can install the Azure Policy for Kubernetes. Learn more about monitoring components for Defender for Cloud.
With the policies defined for your Kubernetes cluster, every request to the Kubernetes API server is monitored against the predefined set of best practices before being persisted to the cluster. You can then configure it to enforce the best practices and mandate them for future workloads.
For example, you can mandate that privileged containers shouldn't be created, and any future requests to do so are blocked.
You can learn more about Kubernetes data plane hardening.
Vulnerability assessment
Defender for Containers scans the cluster node OS and application software, container images in Azure Container Registry (ACR), Amazon AWS Elastic Container Registry (ECR), Google Artifact Registry (GAR), Google Container Registry (GCR), and supported external image registries to provide agentless vulnerability assessment.
Vulnerability information powered by Microsoft Defender Vulnerability Management is added to the cloud security graph for contextual risk, calculation of attack paths, and hunting capabilities.
Learn more about vulnerability assessment for:
Container registries -
- Vulnerability assessments for Azure with Microsoft Defender Vulnerability Management
- Vulnerability assessments for AWS with Microsoft Defender Vulnerability Management
- Vulnerability assessments for GCP with Microsoft Defender Vulnerability Management
Cluster nodes -
Run-time protection for Kubernetes nodes and clusters
Defender for Containers provides real-time threat protection for supported containerized environments and generates alerts for suspicious activities. You can use this information to quickly remediate security issues and improve the security of your containers.
Threat protection is provided for Kubernetes at the cluster, node, and workload levels. Both sensor based coverage that requires the Defender sensor, and agentless coverage that is based on analysis of the Kubernetes audit logs, are used to detect threats. Security alerts are only triggered for actions and deployments that occur after you enabled Defender for Containers on your subscription.
Examples of security events that Microsoft Defenders for Containers monitors include:
- Exposed Kubernetes dashboards
- Creation of high privileged roles
- Creation of sensitive mounts
You can view security alerts by selecting the Security alerts tile at the top of the Defender for Cloud's overview page, or the link from the sidebar.
Security alerts for runtime workload in the clusters have the K8S.NODE_ alert type prefix. For a full list of the cluster level alerts, see the reference table of alerts.
Defender for Containers includes threat detection with over 60 Kubernetes-aware analytics, AI, and anomaly detections based on your runtime workload.
Defender for Cloud monitors the attack surface of multicloud Kubernetes deployments based on the MITRE ATT&CK® matrix for Containers, a framework developed by the Center for Threat-Informed Defense in close partnership with Microsoft.
Defender for Cloud is integrated with Microsoft Defender XDR. When Defender for Containers is enabled, security operators can use Defender XDR to investigate and respond to security issues in supported Kubernetes services.
Learn more
Learn more about Defender for Containers in the following blogs:
Next steps
In this overview, you learned about the core elements of container security in Microsoft Defender for Cloud. To enable the plan, see:
- Enable Defender for Containers
- Check out common questions about Defender for Containers.