defender-for-containers

Name: defender-for-containers
Author: vinayaklatthe

161stars34forks

How to install defender-for-containers?

vinayaklatthe/microsoft-security-skills/defender-for-containers

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers

Installs into the current project.

Summary

Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Covers agentless discovery, agentless vulnerability assessment for images and running containers (powered by Microsoft Defender Vu

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Containers
2
3	Defender for Containers is the Kubernetes-aware plan in Microsoft Defender for Cloud. It
4	covers AKS, Azure Arc-enabled Kubernetes (on-prem, EKS, GKE, OpenShift), and the
5	container registries that feed them, providing posture, image vulnerability assessment,
6	runtime threat detection, and admission control.
7
8	## When to use
9	Securing Kubernetes clusters and the registries that supply them. Use this skill for plan
10	rollout, sensor vs agentless trade-offs, registry scanning, admission policy design, and
11	runtime alert response.
12
13	Do not use this skill for VM/host hardening (`defender-for-servers`), cluster
14	networking design (`azure-network-security-design`), or generic AKS operations (`azure-kubernetes`).
15
16	## Capability map
17
18	\| Capability \| How it works \| Coverage \|
19	\|---\|---\|---\|
20	\| Agentless discovery \| API-based cluster inventory, control-plane misconfig, K8s API audit log analytics \| AKS, EKS, GKE, Arc \|
21	\| Agentless vulnerability assessment \| Snapshots node disks; scans images in registries and running containers \| AKS, EKS, GKE \|
22	\| Registry scanning \| Pull-time, push-time, and continuous scan of images \| ACR, ECR, GAR \|
23	\| Runtime threat detection \| Defender sensor (DaemonSet, eBPF on Linux) — fileless, lateral movement, crypto-miner detections \| AKS, Arc, EKS, GKE \|
24	\| Kubernetes data plane hardening \| Azure Policy add-on (OPA/Gatekeeper) \| AKS, Arc-enabled K8s \|
25	\| Attack path analysis \| Combines posture + vuln + runtime to surface internet → pod → cloud-IAM paths \| All \|
26
27	## Approach
28
29	1. Enable Defender for Containers at subscription scope. Auto-provisioning installs:
30	- Defender sensor (DaemonSet) for runtime detection on Linux nodes.
31	- Azure Policy for Kubernetes add-on for admission control.
32	- Connects ACR scanning automatically.
33	*Verify: `kubectl get ds -n kube-system` shows `microsoft-defender-collector-ds`; AKS
34	shows Defender profile = enabled.*
35
36	2. Connect non-Azure clusters via Arc. EKS/GKE need a connector at the AWS/GCP cloud
37	account level + Arc onboarding for runtime sensor (agentless features work without sensor).
38
39	3. Registry scanning posture. Turn on continuous scanning so newly-disclosed CVEs
40	raise findings on already-pushed images, not just at push time. Set retention so you can
41	answer "is image X vulnerable to CVE-Y" 90 days later.
42
43	4. Image vuln management at the pipeline. Don't wait for runtime: integrate the same
44	MDVM API into CI to fail builds on critical, exploitable CVEs. Pair with image signing
45	(Notation / cosign) and admission control to require signed images.
46
47	5. Runtime threat detection — sensor or agentless?
48	- Sensor required for: fileless attacks, process tree, in-memory exploitation, lateral
49	movement, reverse shell.
50	- Agentless covers: image vuln, posture, K8s API audit-based detections.
51	- Use both in production. Sensor only on Linux node pools (Windows runtime sensor
52	coverage is limited).
53
54	6. Admission control with Azure Policy / Gatekeeper. Roll out as audit for 14 days,
55	then deny. Baseline policies:
56	- No privileged containers.
57	- No `hostPath` mounts to sensitive paths.
58	- Required readOnlyRootFilesystem for app workloads.
59	- Required resource limits.
60	- Required signed images (allowlist registries).
61
62	7. Attack path analysis — review weekly. The high-value paths to fix first are
63	internet-exposed pod with critical CVE → workload identity → cloud IAM. Prioritise by
64	blast radius, not finding count.
65
66	8. Stream alerts to Sentinel via the Defender for Cloud connector. Build hunting queries
67	on `SecurityAlert` filtered to ProductName = "Microsoft Defender for Containers".
68
69	## Guardrails
70	- Defender sensor is required for runtime detection. Agentless alone won't catch
71	reverse shells or c

People who liked this also viewed

6 picks

Type

defender-for-containers

161stars34forks

View on GitHub

How to install defender-for-containers?

vinayaklatthe/microsoft-security-skills/defender-for-containers

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill defender-for-containers

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Defender for Containers
2
3	Defender for Containers is the Kubernetes-aware plan in Microsoft Defender for Cloud. It
4	covers AKS, Azure Arc-enabled Kubernetes (on-prem, EKS, GKE, OpenShift), and the
5	container registries that feed them, providing posture, image vulnerability assessment,
6	runtime threat detection, and admission control.
7
8	## When to use
9	Securing Kubernetes clusters and the registries that supply them. Use this skill for plan
10	rollout, sensor vs agentless trade-offs, registry scanning, admission policy design, and
11	runtime alert response.
12
13	Do not use this skill for VM/host hardening (`defender-for-servers`), cluster
14	networking design (`azure-network-security-design`), or generic AKS operations (`azure-kubernetes`).
15
16	## Capability map
17
18	\| Capability \| How it works \| Coverage \|
19	\|---\|---\|---\|
20	\| Agentless discovery \| API-based cluster inventory, control-plane misconfig, K8s API audit log analytics \| AKS, EKS, GKE, Arc \|
21	\| Agentless vulnerability assessment \| Snapshots node disks; scans images in registries and running containers \| AKS, EKS, GKE \|
22	\| Registry scanning \| Pull-time, push-time, and continuous scan of images \| ACR, ECR, GAR \|
23	\| Runtime threat detection \| Defender sensor (DaemonSet, eBPF on Linux) — fileless, lateral movement, crypto-miner detections \| AKS, Arc, EKS, GKE \|
24	\| Kubernetes data plane hardening \| Azure Policy add-on (OPA/Gatekeeper) \| AKS, Arc-enabled K8s \|
25	\| Attack path analysis \| Combines posture + vuln + runtime to surface internet → pod → cloud-IAM paths \| All \|
26
27	## Approach
28
29	1. Enable Defender for Containers at subscription scope. Auto-provisioning installs:
30	- Defender sensor (DaemonSet) for runtime detection on Linux nodes.
31	- Azure Policy for Kubernetes add-on for admission control.
32	- Connects ACR scanning automatically.
33	*Verify: `kubectl get ds -n kube-system` shows `microsoft-defender-collector-ds`; AKS
34	shows Defender profile = enabled.*
35
36	2. Connect non-Azure clusters via Arc. EKS/GKE need a connector at the AWS/GCP cloud
37	account level + Arc onboarding for runtime sensor (agentless features work without sensor).
38
39	3. Registry scanning posture. Turn on continuous scanning so newly-disclosed CVEs
40	raise findings on already-pushed images, not just at push time. Set retention so you can
41	answer "is image X vulnerable to CVE-Y" 90 days later.
42
43	4. Image vuln management at the pipeline. Don't wait for runtime: integrate the same
44	MDVM API into CI to fail builds on critical, exploitable CVEs. Pair with image signing
45	(Notation / cosign) and admission control to require signed images.
46
47	5. Runtime threat detection — sensor or agentless?
48	- Sensor required for: fileless attacks, process tree, in-memory exploitation, lateral
49	movement, reverse shell.
50	- Agentless covers: image vuln, posture, K8s API audit-based detections.
51	- Use both in production. Sensor only on Linux node pools (Windows runtime sensor
52	coverage is limited).
53
54	6. Admission control with Azure Policy / Gatekeeper. Roll out as audit for 14 days,
55	then deny. Baseline policies:
56	- No privileged containers.
57	- No `hostPath` mounts to sensitive paths.
58	- Required readOnlyRootFilesystem for app workloads.
59	- Required resource limits.
60	- Required signed images (allowlist registries).
61
62	7. Attack path analysis — review weekly. The high-value paths to fix first are
63	internet-exposed pod with critical CVE → workload identity → cloud IAM. Prioritise by
64	blast radius, not finding count.
65
66	8. Stream alerts to Sentinel via the Defender for Cloud connector. Build hunting queries
67	on `SecurityAlert` filtered to ProductName = "Microsoft Defender for Containers".
68
69	## Guardrails
70	- Defender sensor is required for runtime detection. Agentless alone won't catch
71	reverse shells or c

People who liked this also viewed

6 picks

Type