Azure Introduction
Azure Pricing
Azure Threats
Enable Microsoft Defender for Cloud for Azure Containers
More Info:
Ensure that Microsoft Defender for Cloud is enabled for Azure containers.
Risk Level
High
Address
Security, Operational Maturity
Compliance Standards
CISAZURE
Triage and Remediation
Remediation
To enable Microsoft Defender for Cloud for Azure Containers, please follow the below steps:
-
Go to the Azure portal and log in with your credentials.
-
Navigate to the “Security Center” from the left-hand side menu.
-
Click on “Security Center” and then select “Azure Defender” from the top menu.
-
Click on “Container Security” and then select “On” to enable Microsoft Defender for Cloud for Azure Containers.
-
Review the pricing tier options and select the one that suits your requirements.
-
Click on “Save” to apply the changes.
-
Once the changes are saved, you will see the status change to “Enabled” under the “Azure Defender” dashboard.
By following these steps, you will have successfully enabled Microsoft Defender for Cloud for Azure Containers.
To enable Microsoft Defender for Cloud for Azure Containers using AZURE CLI, follow these steps:
-
Open the Azure CLI command prompt and log in to your Azure account.
-
Run the following command to check if the Azure Defender for Container Registries is enabled:
az security atp storage show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>Replace
<registry-id>with the ID of the registry you want to enable Azure Defender for. -
If the Azure Defender for Container Registries is not enabled, run the following command to enable it:
az security atp storage update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled trueReplace
<registry-id>with the ID of the registry you want to enable Azure Defender for. -
Run the following command to check if the Azure Defender for Container Images is enabled:
az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>Replace
<registry-id>with the ID of the registry you want to enable Azure Defender for. -
If the Azure Defender for Container Images is not enabled, run the following command to enable it:
az security atp container update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled trueReplace
<registry-id>with the ID of the registry you want to enable Azure Defender for. -
Finally, run the following command to check the status of the Azure Defender for Container Images:
az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>Replace
<registry-id>with the ID of the registry you want to check the status for.
That’s it! You have successfully enabled Microsoft Defender for Cloud for Azure Containers using AZURE CLI.
To enable Microsoft Defender for Cloud for Azure Containers using Python, you can follow the below steps:
Step 1: Install the Azure SDK for Python using the following command:
pip install azure-mgmt-containerregistry
Step 2: Authenticate with Azure using the following code:
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.containerregistry import ContainerRegistryManagementClient
tenant_id = 'TENANT_ID'
client_id = 'CLIENT_ID'
client_secret = 'CLIENT_SECRET'
subscription_id = 'SUBSCRIPTION_ID'
credentials = ServicePrincipalCredentials(
client_id=client_id,
secret=client_secret,
tenant=tenant_id
)
client = ContainerRegistryManagementClient(credentials, subscription_id)
Step 3: Get the resource group and container registry where you want to enable Microsoft Defender for Cloud. You can use the following code to get the resource group and container registry:
resource_group_name = 'RESOURCE_GROUP_NAME'
registry_name = 'CONTAINER_REGISTRY_NAME'
registry = client.registries.get(resource_group_name, registry_name)
Step 4: Enable Microsoft Defender for Cloud for Azure Containers using the following code:
from azure.mgmt.containerregistry.models import RegistryUpdateParameters
registry_update_params = RegistryUpdateParameters(
policies=registry.policies,
storage_account=registry.storage_account,
identity=registry.identity,
admin_user_enabled=registry.admin_user_enabled,
public_network_access_enabled=registry.public_network_access_enabled,
network_rule_set=registry.network_rule_set,
encryption=registry.encryption,
retention_policy=registry.retention_policy,
trust_policy=registry.trust_policy,
data_endpoint_enabled=True,
data_endpoint_dns_name=None
)
client.registries.update(resource_group_name, registry_name, registry_update_params)
After running the above code, Microsoft Defender for Cloud for Azure Containers will be enabled for the specified container registry.