Ovaj preglednik više nije podržan.
Prijeđite na Microsoft Edge, gdje vas čekaju najnovije značajke, sigurnosna ažuriranja i tehnička podrška.
Microsoft Defender for Containers is the cloud-native solution for securing your containers. It helps protect your clusters whether they're running in:
Azure Kubernetes Service (AKS): Microsoft's managed service for developing, deploying, and managing containerized applications.
Amazon Elastic Kubernetes Service (EKS) in a connected Amazon Web Services (AWS) account: Amazon's managed service for running Kubernetes on AWS without needing to install, operate, and maintain your own Kubernetes control plane or nodes.
Google Kubernetes Engine (GKE) in a connected Google Cloud Platform (GCP) project: Google's managed environment for deploying, managing, and scaling applications by using GCP infrastructure.
Other Kubernetes distributions (using Azure Arc-enabled Kubernetes): Cloud Native Computing Foundation (CNCF) certified Kubernetes clusters hosted on-premises or on infrastructure as a service (IaaS). For more information, see Containers support matrix in Defender for Cloud.
You can first learn how to connect and help protect your containers in these articles:
You can also learn more by watching these videos from the Defender for Cloud in the field video series:
Napomena
Defender for Containers support for Azure Arc-enabled Kubernetes clusters is a preview feature. The preview feature is available on a self-service, opt-in basis.
Previews are provided as is and as available. They're excluded from the service-level agreements and the limited warranty.
To learn more about the supported operating systems, feature availability, outbound proxy, and more, see Containers support matrix in Defender for Cloud.
Validate that the following endpoints are configured for outbound access so that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.
The Defender sensor must connect to the configured Azure Monitor Log Analytics workspace. By default, AKS clusters have unrestricted outbound (egress) internet access. If event egress from the cluster requires the use of an Azure Monitor Private Link Scope (AMPLS), you must:
For instructions, refer to Create an Azure Monitor Private Link Scope.
Validate that the following endpoints for public cloud deployments are configured for outbound access. Configuring them for outbound access helps ensure that the Defender sensor can connect to Microsoft Defender for Cloud to send security data and events.
| Azure domain | Azure Government domain | Azure operated by 21Vianet domain | Port |
|---|---|---|---|
| *.ods.opinsights.azure.com | *.ods.opinsights.azure.us | *.ods.opinsights.azure.cn | 443 |
| *.oms.opinsights.azure.com | *.oms.opinsights.azure.us | *.oms.opinsights.azure.cn | 443 |
| login.microsoftonline.com | login.microsoftonline.us | login.chinacloudapi.cn | 443 |
You also need to validate the Azure Arc-enabled Kubernetes network requirements.
In Defender for Cloud, select Environment Settings, and then select the relevant subscription.
On the Defender plans page, toggle the Containers plan to On and then select its Settings link.
Turn on the relevant component.
Napomena
By default, when you enable the plan through the Azure portal, Microsoft Defender for Containers is configured to automatically enable all capabilities and install all required components to provide the protections that the plan offers. This configuration includes the assignment of a default workspace.
If you don't want to enable all capabilities of the plans, you can manually select which specific capabilities to enable by selecting the Settings link for the Containers plan. Then, on the Settings & monitoring page, select the capabilities that you want to enable.
You can also modify this configuration from the Defender plans page after initial configuration of the plan.
For detailed information on the enablement method for each capability, see the support matrix.
Learn more about the roles for provisioning Defender for Containers extensions.
You can assign a custom workspace through Azure Policy.
Capabilities that require sensor installation can also be deployed on one or more Kubernetes clusters. Use the appropriate recommendation:
| Sensor | Recommendation |
|---|---|
| Defender sensor for Kubernetes | Azure Kubernetes Service clusters should have Defender profile enabled |
| Defender sensor for Azure Arc-enabled Kubernetes | Azure Arc-enabled Kubernetes clusters should have the Defender extension installed |
| Azure Policy agent for Kubernetes | Azure Kubernetes Service clusters should have the Azure Policy Add-on for Kubernetes installed |
| Azure Policy agent for Azure Arc-enabled Kubernetes | Azure Arc-enabled Kubernetes clusters should have the Azure Policy extension installed |
To deploy the Defender sensor on specific clusters:
On the Microsoft Defender for Cloud Recommendations page, open the Enable enhanced security security control or search for one of the preceding recommendations. (You can also use the preceding links to open the recommendation directly.)
View all clusters without a sensor by opening the Unhealthy tab.
Select the clusters where you want to deploy the sensor, and then select Fix.
Select Fix X resources.
You can enable the Defender for Containers plan and deploy all of the relevant components by using the Azure portal, the REST API, or an Azure Resource Manager template. For detailed steps, select the relevant tab.
After the Defender sensor is deployed, a default workspace is automatically assigned. You can assign a custom workspace in place of the default workspace through Azure Policy.
Napomena
The Defender sensor is deployed to each node to provide the runtime protections and collect signals from those nodes by using eBPF technology.
You can use Azure portal pages to enable the Defender for Cloud plan and set up automatic provisioning of all the necessary components for defending your Kubernetes clusters at scale. The process is streamlined.
A dedicated Defender for Cloud recommendation provides:
To deploy the sensor:
On the Microsoft Defender for Cloud Recommendations page, open the Enable enhanced security security control.
Use the filter to find the recommendation named Azure Kubernetes Service clusters should have Defender profile enabled.
Savjet
Notice the Fix icon in the Actions column.
Select the clusters to see the details of the healthy and unhealthy resources (clusters with and without the sensor).
In the list of unhealthy resources, select a cluster. Then select Remediate to open the pane with the remediation confirmation.
Select Fix X resources.
In Defender for Cloud, select Settings, and then select the relevant subscription.
On the Defender plans page, select Containers > Settings.
Turn on the relevant component.
Napomena
When you turn off Defender for Containers, the components are set to Off. They're not deployed to any more containers, but they're not removed from containers where they're already installed.
By default, when you enable the plan through the Azure portal, Microsoft Defender for Containers is configured to automatically install required components to provide the protections that the plan offers. This configuration includes the assignment of a default workspace.
If you want to disable automatic installation of components during the onboarding process, select Edit configuration for the Containers plan. The advanced options appear, and you can disable automatic installation for each component.
You can also modify this configuration from the Defender plans page.
Napomena
If you choose to disable the plan at any time after you enable it through the portal, you'll need to manually remove Defender for Containers components deployed on your clusters.
You can assign a custom workspace through Azure Policy.
If you disable the automatic installation of any component, you can easily deploy the component to one or more clusters by using the appropriate recommendation:
Learn more about the roles for provisioning Defender for Containers extensions.
Before you deploy the sensor, ensure that you:
You can deploy the Defender sensor by using a range of methods. For detailed steps, select the relevant tab.
A dedicated Defender for Cloud recommendation provides:
To deploy the sensor:
On the Microsoft Defender for Cloud Recommendations page, open the Enable enhanced security security control.
Use the filter to find the recommendation named Azure Arc-enabled Kubernetes clusters should have Microsoft Defender's extension enabled.
Savjet
Notice the Fix icon in the Actions column.
Select the sensor to see the details of the healthy and unhealthy resources (clusters with and without the sensor).
In the list of unhealthy resources, select a cluster. Then select Remediate to open the pane with the remediation options.
Select the relevant Log Analytics workspace, and then select Remediate x resource.
To verify that your cluster has the Defender sensor installed on it, follow the steps on one of the following tabs.
On the Microsoft Defender for Cloud Recommendations page, open the Enable Microsoft Defender for Cloud security control.
Select the recommendation named Azure Arc-enabled Kubernetes clusters should have Microsoft Defender's extension enabled.
Check that the cluster on which you deployed the sensor is listed as Healthy.
Važno
To help protect your EKS clusters, enable the Defender for Containers plan on the relevant account connector:
In Defender for Cloud, open Environment settings.
Select the AWS connector.
Select the Defender plans page and verify that the toggle for the Containers plan is set to On.
To change optional configurations for the plan, select Settings.
The Agentless threat protection feature provides runtime protection to your cluster containers. The feature sends Kubernetes audit logs to Microsoft Defender. Set the Agentless threat protection toggle to On and set the retention period of your audit logs.
Napomena
If you disable this configuration, control plane threat detection is disabled. Learn more about feature availability.
K8S API access sets permissions to allow API-based discovery of your Kubernetes clusters. To enable, set the K8S API access toggle to On.
Registry access sets permissions to allow vulnerability assessment of images stored in ECR. To enable, set the Registry access toggle to On.
Continue through the remaining pages of the connector wizard.
If you're enabling the Agentless discovery for Kubernetes feature, you need to grant control plane permissions on the cluster. You can grant permissions in one of the following ways:
Run this Python script. The script adds the Defender for Cloud role MDCContainersAgentlessDiscoveryK8sRole to aws-auth ConfigMap for the EKS clusters that you want to onboard.
Grant each Amazon EKS cluster the MDCContainersAgentlessDiscoveryK8sRole role with the ability to interact with the cluster. Sign in to all existing and newly created clusters by using eksctl and run the following script:
eksctl create iamidentitymapping \
--cluster my-cluster \
--region region-code \
--arn arn:aws:iam::account:role/MDCContainersAgentlessDiscoveryK8sRole \
--group system:masters\
--no-duplicate-arns
For more information, see Grant IAM users access to Kubernetes with EKS access entries in the Amazon EKS user guide.
Azure Arc-enabled Kubernetes, the Defender sensor, and Azure Policy for Kubernetes should be installed and running on your EKS clusters. There's a dedicated Defender for Cloud recommendation to install these extensions (and Azure Arc, if necessary): EKS clusters should have Microsoft Defender's extension for Azure Arc installed.
Follow the remediation steps provided by the recommendation:
Savjet
You can simulate container alerts by following the instructions in this blog post.
To view the alerts and recommendations for your EKS clusters, use the filters on the alerts, recommendations, and inventory pages to filter by resource type AWS EKS Cluster.
To deploy the Defender sensor on your AWS clusters:
Go to Microsoft Defender for Cloud > Environment settings > Add environment > Amazon Web Services.
Fill in the account details.
Go to Select plans, open the Containers plan, and make sure Auto provision Defender's sensor for Azure Arc is set to On.
Go to Configure access and follow the steps there.
After the Cloud Formation template is deployed successfully, select Create.
Napomena
You can exclude a specific AWS cluster from automatic provisioning. For sensor deployment, apply the ms_defender_container_exclude_agents tag on the resource with the value true. For agentless deployment, apply the ms_defender_container_exclude_agentless tag on the resource with the value true.
Važno
If you haven't connected a GCP project, connect your GCP project to Microsoft Defender for Cloud.
To help protect your GKE clusters, use the following steps to enable the Defender for Containers plan on the relevant GCP project.
Napomena
Verify that you don't have any Azure policies that prevent the Azure Arc installation.
Sign in to the Azure portal.
Go to Microsoft Defender for Cloud > Environment settings.
Select the relevant GCP connector.
Select the Next: Select plans > button.
Ensure that the toggle for the Containers plan is On.
To change optional configurations for the plan, select Settings.
Agentless threat detection: Enabled by default. This configuration is available at the GCP project level only. It provides agentless collection of the audit log data through GCP Cloud Logging to the Microsoft Defender for Cloud back end for further analysis. Defender for Containers requires control plane audit logs to provide runtime threat protection. To send Kubernetes audit logs to Microsoft Defender, set the toggle to On.
Napomena
If you disable this configuration, the control plane threat detection feature is also disabled. Learn more about feature availability.
Auto provision Defender's sensor for Azure Arc and Auto provision Azure Policy extension for Azure Arc: Enabled by default. You can install Azure Arc-enabled Kubernetes and its extensions on your GKE clusters in three ways:
The K8S API access feature provides API-based discovery of your Kubernetes clusters. Set the K8S API access toggle to On.
The Registry access feature provides vulnerability management for images stored in Google registries (Google Artifact Registry and Google Container Registry) and running images on your GKE clusters. Set the Registry access toggle to On.
Select the Copy button.
Select the GCP Cloud Shell > button.
Paste the script into the Cloud Shell terminal and run it.
The connector is updated after the script runs. This process can take up to 8 hours to finish.
If you set any of the default automatic provisioning configurations to Off during the GCP connector onboarding process or afterward, you need to manually install Azure Arc-enabled Kubernetes, the Defender sensor, and Azure Policy for Kubernetes in each of your GKE clusters. Installing them helps ensure that you get the full security value out of Defender for Containers.
You can use two dedicated Defender for Cloud recommendations to install the extensions (and Azure Arc, if necessary):
Napomena
When you're installing Arc extensions, you must verify that the provided GCP project is identical to the one in the relevant connector.
To deploy the solution to specific clusters:
Sign in to the Azure portal.
Go to Microsoft Defender for Cloud > Recommendations.
On the Defender for Cloud Recommendations page, search for one of the recommendations by name.
Select an unhealthy GKE cluster.
Važno
You must select clusters one at a time.
Don't select the clusters by their hyperlinked names. Select anywhere else in the relevant row.
Select the name of the unhealthy resource.
Select Fix.
Defender for Cloud generates a script in the language of your choice:
Select Download remediation logic.
Run the generated script on your cluster.
Repeat steps 3 through 8 for the other recommendation.
Sign in to the Azure portal.
Go to Microsoft Defender for Cloud > Security alerts.
Select the 
button.
On the Filter dropdown menu, select Resource type.
On the Value dropdown menu, select GCP GKE Cluster.
Select Ok.
To deploy the Defender sensor on your GCP clusters:
Go to Microsoft Defender for Cloud > Environment settings > Add environment > Google Cloud Platform.
Fill in the account details.
Go to Select plans, open the Containers plan, and make sure Auto provision Defender's sensor for Azure Arc is set to On.
Go to Configure access and follow the steps there.
After the gcloud script runs successfully, select Create.
Napomena
You can exclude a specific GCP cluster from automatic provisioning. For sensor deployment, apply the ms_defender_container_exclude_agents label on the resource with the value true. For agentless deployment, apply the ms_defender_container_exclude_agentless label on the resource with the value true.
A full list of supported alerts is available in the reference table of all Defender for Cloud security alerts.
To simulate a security alert:
Run the following command from the cluster:
kubectl get pods --namespace=asc-alerttest-662jfi039n
The expected response is No resource found.
Within 30 minutes, Defender for Cloud detects this activity and triggers a security alert.
Napomena
Azure Arc isn't a prerequisite for simulating agentless alerts for Defender for Containers.
In the Azure portal, go to Microsoft Defender for Cloud > Security alerts and look for the alert on the relevant resource.
To remove this (or any) Defender for Cloud extension, it's not enough to turn off automatic provisioning:
Napomena
To disable the Defender for Containers plan entirely, go to Environment settings and turn off Microsoft Defender for Containers.
Nevertheless, to ensure that the Defender for Containers components aren't automatically provisioned to your resources from now on, disable automatic provisioning of the extensions.
You can remove the extension from currently running machines by using the Azure portal, the Azure CLI, or the REST API, as explained on the following tabs.
In the Azure portal, open Azure Arc.
In the infrastructure list, select Kubernetes clusters, and then select the specific cluster.
Open the Extensions page, which lists extensions on the cluster.
Select the extension, and then select Uninstall.
The Defender sensor uses the Log Analytics workspace as a data pipeline to send data from the cluster to Defender for Cloud. The workspace doesn't retain any of the data. As a result, users aren't billed in this use case.
The Defender sensor uses a default Log Analytics workspace. If you don't have a default Log Analytics workspace, Defender for Cloud creates a new resource group and default workspace when you install the Defender sensor. The default workspace is based on your region.
The naming convention for the default Log Analytics workspace and resource group is:
When you enable automatic provisioning, a default workspace is automatically assigned. You can assign a custom workspace through Azure Policy.
To check if you have a workspace assigned:
Sign in to the Azure portal.
Search for and select Policy.
Select Definitions.
Search for policy ID 64def556-fbad-4622-930e-72d1d5589bf5.
Select Configure Azure Kubernetes Service clusters to enable Defender profile.
Select Assignments.
Use one of the next sections in this article as follows:
If the policy isn't yet assigned, the Assignments tab shows the number 0.
To assign a custom workspace:
Select Assign.
On the Parameters tab, clear the Only show parameters that need input or review option.
Select a LogAnalyticsWorkspaceResourceId value from the dropdown menu.
Select Review + create.
Select Create.
If the policy is assigned to a workspace, the Assignments tab shows the number 1.
Napomena
If you have more than one subscription, the number might be higher.
To assign a custom workspace:
Select the relevant assignment.
Select Edit assignment.
On the Parameters tab, clear the Only show parameters that need input or review option.
Select a LogAnalyticsWorkspaceResourceId value from the dropdown menu.
Select Review + save.
Select Save.
The Defender sensor uses the Log Analytics workspace as a data pipeline to send data from the cluster to Defender for Cloud. The workspace doesn't retain any of the data. As a result, users aren't billed in this use case.
The Defender sensor uses a default Log Analytics workspace. If you don't have a default Log Analytics workspace, Defender for Cloud creates a new resource group and default workspace when you install the Defender sensor. The default workspace is based on your region.
The naming convention for the default Log Analytics workspace and resource group is:
When you enable automatic provisioning, a default workspace is automatically assigned. You can assign a custom workspace through Azure Policy.
To check if you have a workspace assigned:
Sign in to the Azure portal.
Search for and select Policy.
Select Definitions.
Search for policy ID 708b60a6-d253-4fe0-9114-4be4c00f012c.
Select Configure Azure Arc enabled Kubernetes clusters to install Microsoft Defender for Cloud extension.
Select Assignments.
Use one of the next sections in this article as follows:
If the policy isn't yet assigned, the Assignments tab shows the number 0.
To assign a custom workspace:
Select Assign.
On the Parameters tab, clear the Only show parameters that need input or review option.
Select a LogAnalyticsWorkspaceResourceId value from the dropdown menu.
Select Review + create.
Select Create.
If the policy is assigned to a workspace, the Assignments tab shows the number 1.
Napomena
If you have more than one subscription, the number might be higher. If you have a number 1 or higher but the assignment isn't on the relevant scope, follow the Create a new assignment with a custom workspace steps.
To assign a custom workspace:
Select the relevant assignment.
Select Edit assignment.
On the Parameters tab, clear the Only show parameters that need input or review option.
Select a LogAnalyticsWorkspaceResourceId value from the dropdown menu.
Select Review + save.
Select Save.
To remove this (or any) Defender for Cloud extension, it's not enough to turn off automatic provisioning:
Napomena
To disable the Defender for Containers plan entirely, go to Environment settings and turn off Microsoft Defender for Containers.
Nevertheless, to ensure that the Defender for Containers components aren't automatically provisioned to your resources from now on, disable automatic provisioning of the extensions.
You can remove the extension from currently running machines by using the REST API, the Azure CLI, or a Resource Manager template, as explained on the following tabs.
To remove the extension by using the REST API, run the following PUT command:
https://management.azure.com/subscriptions/{{SubscriptionId}}/resourcegroups/{{ResourceGroup}}/providers/Microsoft.ContainerService/managedClusters/{{ClusterName}}?api-version={{ApiVersion}}
The command includes these parameters:
| Name | Description | Mandatory |
|---|---|---|
SubscriptionId |
Cluster's subscription ID | Yes |
ResourceGroup |
Cluster's resource group | Yes |
ClusterName |
Cluster's name | Yes |
ApiVersion |
API version; must be 2022-06-01 or later | Yes |
This is the request body:
{
"location": "{{Location}}",
"properties": {
"securityProfile": {
"defender": {
"securityMonitoring": {
"enabled": false
}
}
}
}
}
The request body has these parameters:
| Name | Description | Mandatory |
|---|---|---|
location |
Cluster's location | Yes |
properties.securityProfile.defender.securityMonitoring.enabled |
Determines whether to enable or disable Microsoft Defender for Containers on the cluster | Yes |
Now that you enabled Defender for Containers, you can:
Obuka
Modul
Configure an Azure Kubernetes Service cluster - Training
Use Azure Policy to enforce policies and safeguards on your Kubernetes clusters at scale. Azure Policy Ensures that your cluster is secure, compliant, and consistent across your organization.
Certifikacija
Microsoft Certified: Security Operations Analyst Associate - Certifications
Investigate, search for, and mitigate threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender.
Dokumentacija
Overview of Container security in Microsoft Defender for Containers - Microsoft Defender for Cloud
Learn about Microsoft Defender for Containers
Microsoft Defender for Kubernetes - the benefits and features - Microsoft Defender for Cloud
Learn about the benefits and features of Microsoft Defender for Kubernetes and how it provides real-time threat protection for your Azure Kubernetes Service (AKS) containerized environments.
Learn how to enable the Defender for Containers plan on your Azure subscription for Microsoft Defender for Cloud.