Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable Microsoft Defender for Cloud for Azure Containers

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: SecurityCenter-037

Ensure that Microsoft Defender for Cloud is enabled for all your Azure containers. Turning on the Defender for Cloud service enables threat detection for containers, providing threat intelligence, anomaly detection, and behavior analytics.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Security

By default, Microsoft Defender for Cloud is not enabled for your Azure cloud containers. Enabling the Defender security service for Azure containers allows for advanced security defense against threats, using threat detection capabilities provided by the Microsoft Security Response Center (MSRC).


Audit

To determine if the Microsoft Defender for Cloud security service is enabled for your Azure containers, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to Microsoft Defender for Cloud blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0.

03 In the main navigation panel, under Management, choose Environment settings.

04 Click on the name (link) of the Azure subscription that you want to examine.

05 In the navigation panel, under Settings, choose Defender plans to access the Defender for Cloud pricing plans available for the selected subscription.

06 On the Defender plans page, check the Defender for Cloud pricing plan status available for the Containers resource type, listed in the Plan column. If the pricing plan status for Containers is set to Off, Microsoft Defender for Cloud is not enabled for the Azure containers deployed in the selected subscription.

07 Repeat step no. 4 – 6 for each Microsoft Azure subscription available within your cloud account.

Using Azure CLI

01 Run account get-access-token command (Windows/macOS/Linux) with custom query filters to describe the name of the Defender for Cloud pricing plan configured for the Azure containers available within the current subscription:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings?api-version=2018-06-01' | jq '.|.value[] | select(.name=="Containers")'|jq '.properties.pricingTier'

02 The command output should return the name of the configured pricing tier:

"Free"

If the account get-access-token command output does not return "Standard" for the name of the pricing tier, Microsoft Defender for Cloud is not enabled for the Azure containers deployed within the current subscription.

03 Repeat steps no. 1 and 2 for each Microsoft Azure subscription available in your cloud account.

Remediation / Resolution

To enable Microsoft Defender for Cloud for your Azure cloud containers, perform the following actions:

Note: Turning on Defender for Cloud for the specified resource type (i.e. containers) incurs an additional cost per resource.

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to Microsoft Defender for Cloud blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0.

03 In the main navigation panel, under Management, choose Environment settings.

04 Click on the name (link) of the Azure subscription that you want to access.

05 In the navigation panel, under Settings, choose Defender plans to access the Defender for Cloud pricing plans available for the selected subscription.

06 On the Defender plans configuration page, under Microsoft Defender for, choose On for the Containers pricing plan listed in the Plan column, to enable Microsoft Defender for Cloud for Azure containers. Choose Save from the top menu to apply the changes.

07 Repeat step no. 4 – 6 for each Microsoft Azure subscription available within your cloud account.

Using Azure CLI

01 Define the configuration parameters for the account get-access-token command, where the "pricingTier" parameter value is set to "Standard" to turn on the Defender for Cloud pricing plan for containers. Save the configuration document to a JSON file named enable-defender-for-containers.json and replace the highlighted details, i.e. <azure-subscription-id>, with your own Azure account subscription ID:

{
"id": "/subscriptions/<azure-subscription-id>/providers/Microsoft.Security/pricings/Containers",
  "name": "Containers",
  "type": "Microsoft.Security/pricings",
  "properties": {
    "pricingTier": "Standard"
  }
}

02 Run account get-access-token command (Windows/macOS/Linux) using the configuration document defined at the previous step (i.e. enable-defender-for-containers.json file), to enable Microsoft Defender for Cloud for all the Azure containers deployed in the selected subscription:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings/Containers?api-version=2018-06-01 -d@"enable-defender-for-containers.json"'

03 The command output should return the information available for the enabled pricing tier:

{
  "id": "/subscriptions/abcd1234-abcd-1234-abcd-1234abcd1234/providers/Microsoft.Security/pricings/Containers",
  "name": "Containers",
  "type": "Microsoft.Security/pricings",
  "properties": {
    "pricingTier": "Standard",
    "freeTrialRemainingTime": "PT0S"
  }
}

04 Repeat steps no. 1 – 3 for each Microsoft Azure subscription available in your cloud account.

References

Publication date Feb 19, 2022

Unlock the Remediation Steps


Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

Confirmity Cloud Platform

No thanks, back to article

You are auditing:

Enable Microsoft Defender for Cloud for Azure Containers

Risk Level: High