lacework-global-605
2.1.8 Ensure That Microsoft Defender for Containers Is Set To 'On' (Manual)
Profile Applicability
• Level 2
Description
Turning on Microsoft Defender for Containers enables threat detection for Container Registries including Kubernetes, providing threat intelligence, anomaly detection, and behavior analytics in the Microsoft Defender for Cloud.
Rationale
Enabling Microsoft Defender for Container Registries allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).
Impact
Turning on Microsoft Defender for Containers incurs an additional cost per resource.
Audit
From Azure Portal
- Go to
Microsoft Defender for Cloud
- Select
Environment Settings
under the 'Management' heading. - Click on the subscription name
- Select
Defender plans
under the 'Settings' heading. - For
Containers
the sliding button under the 'Status' heading should beOn
If the tenant is licensed and enabled, the output should indicateStandard
From Azure CLI
Ensure the output of the below command is Standard under the PricingTier column.
az security pricing show "ContainerRegistry" --query pricingTier
From Azure PowerShell
Get-AzSecurityPricing -Name 'ContainerRegistry' | Select-Object Name,PricingTier
Ensure output for -PricingTier
is Standard
Remediation
From Azure Portal
- Go to
Microsoft Defender for Cloud
- Select
Environment Settings
under the 'Management' heading. - Click on the subscription name
- Select
Defender plans
under the 'Settings' heading. - For
Containers
click the sliding button under theStatus
heading to beOn
- Click
Save
in the top left.
From Azure CLI
Use the below command to enable Standard pricing tier for Storage
az security pricing create -n 'ContainerRegistry' --tier 'standard'
From Azure PowerShell
Set-AzSecurityPricing -Name 'ContainerRegistry' -PricingTier 'Standard'
References
https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/list
https://docs.microsoft.com/en-us/rest/api/securitycenter/pricings/update
https://docs.microsoft.com/en-us/powershell/module/az.security/get-azsecuritypricing
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-1-enable-threat-detection-capabilities
https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction?tabs=defender-for-container-arch-aks