Blog Post

Microsoft Defender for Cloud Blog
2 MIN READ

Exporting Azure Container Registry Vulnerability Assessment in Microsoft Defender for Cloud

YuriDiogenes's avatar
YuriDiogenes
Icon for Microsoft rankMicrosoft
Mar 26, 2020
Using Microsoft Defender for Containers  plan, you can monitor your ARM-based Azure Container Registry. When a new image is pushed, Microsoft Defender for Cloud scans the image using a scanner from t...
Updated Oct 28, 2021
Version 6.0
ktaylor2285's avatar
ktaylor2285
Copper Contributor
Nov 19, 2021
Microsoft Defender for Cloud , Recommendation , All recommendations
 
Run below kusto queries in Azure Resource Graph Explorer.
 
 
securityresources
| where type == "microsoft.security/assessments"
| extend displayName = trim(" ", tostring(properties.metadata.displayName))
| where displayName == "Deprecated accounts should be removed from your subscription"
 
 
securityresources
| where type == "microsoft.security/assessments"
| extend source = trim(' ', tolower(tostring(properties.resourceDetails.Source)))
| extend resourceId = trim(' ', tolower(tostring(case(source =~ "azure", properties.resourceDetails.Id,extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,id)))))
| extend displayName = trim(" ", tostring(properties.metadata.displayName))
| extend description = trim(" ", tostring(properties.metadata.description))
| extend remediationDescription = trim(" ", tostring(properties.metadata.remediationDescription))
| extend status = trim(" ", tostring(properties.status.code))
| extend cause = trim(" ", tostring(properties.status.cause))
| extend severity = trim(" ", tostring(properties.metadata.severity))
| extend userImpact = trim(" ", tostring(properties.metadata.userImpact))
| extend azurePortal = trim(" ", tostring(properties.links.azurePortal))
| extend statusChangeDate = trim(" ", tostring(properties.status.statusChangeDate))
| extend assessmentKey = tostring(name)
| where displayName == "Deprecated accounts should be removed from your subscription"
| sort by todatetime(statusChangeDate)
 
 
// *** displayName = Recommendation column in below screenshot.
// *** status = Unhealthy resources column in below screenshot.