New innovations in container security with unified visibility, investigations, and response actions
Container technology has become essential for modern application development and deployment. It's a critical component for over 90% of cloud-native organizations, facilitating swift, reliable, and flexible processes that drive digital transformation. This advancement has transformed software delivery and fostered innovation. The container market is growing rapidly, with containers-as-a-service adoption expected to reach 52% by 2024. However, as adoption accelerates and container capabilities evolve, organizations face rising container security challenges. The ephemeral and dynamic nature of containers makes it difficult to identify which ones are running at any given time and even harder to identify faulty or vulnerable containers. This makes it challenging for security teams to pinpoint the source of a security incident, putting the organization at risk of undetected threats. Consequently, tracking traffic flow and detecting runtime anomalies become more complex, thereby exposing critical systems to potential security breaches. In addition to that, the lack of expertise in containerized and cloud-native environments, combined with overwhelming vulnerability scan results, makes it difficult to detect, prioritize, and address critical security gaps, leaving the organization’s security weak and disjointed. To address these challenges, Microsoft Defender for Cloud, our Cloud Native Application Protection Platform (CNAPP), is enhancing its’ container security capabilities from development to runtime. These enhancements start with enhanced discovery, providing agentless visibility into Kubernetes environments, tracking containers, pods, and applications as they scale across the entire lifecycle. It strengthens security posture offering continuous and granular scanning from build to runtime, helping maintain compliance and secure configurations across all stages of the SDLC. Finally, Defender for Cloud’s native integration with Defender XDR delivers threat protection with real-time monitoring, prioritizing vulnerabilities based on risk and enabling SOC analysts to detect and respond to threats faster through rich contextual insights and cloud-native response tools. Today, we are excited to announce new and enhanced innovations in Defender for Cloud for securing containerized environments: Elevate your container posture: From agentless discovery to risk prioritization Enhanced container image discovery is now generally available, to ensure images are accurately identified and scanned for risks. Kubernetes Identity and Access information, now in public preview to enhance security by offering critical visibility into access permissions and potential attack paths within Kubernetes environments. Tagging and automatic classification of critical assets through pre-defined rules for prioritization is now generally available to improve response times and operational resilience. Breakthroughs in container security to strengthen the software supply chain across the SDLC Command line interface (CLI) tool for container image scanning at build phase, is now in public preview, integrating security into every phase of development. Vulnerability assessment of container images in third party registries, now in public preview to provide continuous vulnerability scanning across third party registries such as Docker Hub and JFrog Artifactory. Agentless vulnerability assessments for host VMs, now in public preview, enhances the security and compliance for servers in Managed Kubernetes services. Azure Kubernetes Service (AKS) security dashboard for cluster admin view, now in public preview, provides granular visibility into container security directly within the AKS portal. Container defense in action: Enhanced threat detection and response with Defender XDR integration Kubernetes process alert, powered by Microsoft Defender for Endpoint (MDE) detection engine, is now generally available, expanding threat coverage for containerized environments. Binary drift detection, now generally available, provides real-time detection and response to unauthorized changes in container configurations, ensuring container security during runtime. Malware detection for Kubernetes host is now in public preview, ensuring comprehensive protection for both container workloads and underlying host infrastructure. Threat analytics report for containers incidents in Defender XDR, now generally available, providing SOC teams with detailed insights into potential attack methods, and incident investigation. Cloud process events and investigation queries in Defender XDR, now in public preview enhance investigation depth with process data and built-in queries Kubernetes response actions for container workloads is now in public preview to rapidly contain threats in near real-time. AI-powered guided threat remediation, now generally available, empowers SOC teams to efficiently manage container-specific incidents with step-by-step assistance, even with minimal expertise. In this blog, we will share more details on each of these announcements and how they address the typical challenges organizations face when securing containerized applications from build to runtime. Elevate your container posture: From agentless discovery to risk prioritization Effective container security starts with discovery. Without a clear understanding of what’s running in the environment, securing it becomes an impossible task. Containers are dynamic and ephemeral, making it challenging to track them, monitor vulnerabilities, and secure configurations. This is where enhanced container image discovery becomes essential—ensuring that container images are accurately identified and scanned for potential risks. To address this need, we’re excited to announce enhanced container image discovery, providing full visibility into container images, collecting comprehensive inventory data and offering insights into all images in the cloud environment, directly within the cloud security explorer. Once containers are discovered, the next step is managing access and understanding how vulnerabilities can be exploited. Role-Based Access Controls (RBAC) are crucial for managing permissions and access within Kubernetes environments. Microsoft Defender for Cloud now provides critical findings to help teams secure access within clusters and across cloud environments. Introducing the new Kubernetes Identity and Access information in Defender for Cloud, security teams can now query identities, access data, and visualize how over-permissive authorization can lead to lateral movement. To further strengthen container security posture, Defender for Cloud maps all possible attack routes with a new attack path analysis engine. This capability helps detect and address complex threats from Kubernetes to cloud and vice versa across multicloud environments, before a breach occurs, proactively securing Kubernetes environments. Taking our commitment to enhanced container security and operational resilience a step further, Defender for Cloud helps improves response times, reduces downtime, and sets the stage for future automation with manual tagging of critical assets and automatic classification of critical assets in Kubernetes environment. Manual tagging empowers teams to explicitly identify their most critical Kubernetes assets, ensuring these receive top priority. Auto criticality, however, uses research-backed rules and cross-customer insights to automatically assign criticality levels to containers, identifying risks security teams might overlook. Enhanceddata added to the Cloud Security Explorer including enhanced image discovery and Kubernetes RBAC data. Breakthroughs in container security to strengthen the software supply chain across the SDLC As cloud-native applications grow rapidly, integrating security into every development stage becomes critical. Microsoft Defender for Cloud simplifies this by scanning container images from their creation in the CI/CD pipeline to registries and host VMs, strengthening the security posture without slowing down development due to late-stage fixes. We are excited to offer a command-line interface (CLI) tool that allows seamless integration into any CI/CD pipeline. The CLI tool scans container images in the CI/CD pipeline, enabling developers to detect and block vulnerabilities during image building at any stage. Through this integration, Defender for Cloud provides visibility into onboarded pipelines and all container images pushed from those pipelines, allowing security teams to identify the source of the container image. After an image is built, scanned, and remediated, it’s pushed to a container registry until deployment. Continuous scanning, including daily registry rescans, helps identify zero-day vulnerabilities and ensures all images, even those bypassing the monitored pipeline, are fully scanned. In addition to its native support for scanning container images in cloud registries, Defender for Cloud is excited to also support vulnerability assessment of container images in third party registries, including Docker Hub Container Registry and JFrog Artifactory. Defender for Cloud scans CI/CD pipelines and integrates with container registries, meeting developers and DevOps teams where they manage images. This seamless scanning for vulnerabilities simplifies management and offers centralized visibility into images across environments. The container registry scan results are available to both the development and security teams, so they can quickly patch, update or block images before they’re pushed to production. The goal of a secure software supply chain is not only to prevent the use of vulnerable container images but also to ensure that the container infrastructure is secure throughout its lifecycle. Kubernetes host is the foundation of a containerized environment. If the host is compromised, it can lead to the entire cluster being at risk. Attackers could gain access to sensitive data, disrupt services, or even take control of the entire infrastructure. To enhance container security and compliance, Defender for Cloud now includes agentless vulnerability assessments for host VMs in Managed Kubernetes services (AKS only). While securing container images at the build and registry stages is critical for preventing vulnerabilities early in the development process, it’s equally important to maintain strong security once those containers are deployed and running. To facilitate this, the new AKS Security Dashboard empowers resource owners or cluster administrators with a simplified, streamlined experience, offering granular visibility into container posture assessments directly within the AKS portal. This includes vulnerability assessments for hosts and container images including CVE remediation, compliance checks, and security best practices, enabling more efficient security management. Development teams and cluster operators can now access these insights without switching tools, enhancing communication between development and security disciplines, offering actionable recommendations at the cluster level. Container defense in action: Enhanced threat detection and response with Defender XDR integration Ensuring runtime security is vital to maintain the integrity of applications in shared environments. Continuous monitoring, enforcing isolation, and detecting anomalies help prevent and respond to threats in real-time, keeping containers secure throughout their lifecycle. Building on these essential security measures, we are excited to announce that our unique eBPF sensor now provides Kubernetes alerts, powered by Microsoft Defender for Endpoint (MDE) detection engine in the backend. We've optimized Microsoft Defender for Endpoint to effectively detect threats in containerized environments. By validating detections, enriching them with container-specific context, and fine-tuning alerts based on the Microsoft Kubernetes threat matrix, developed and maintained up to date by Microsoft security researchers, we've ensured a balance of comprehensive threat coverage and accurate detection. Runtime security demands vigilance against unauthorized changes, orbinary drift, in container images—a key indicator of potential attacks. With Microsoft Defender for Cloud, you can now detect and respond to these changes in real-time, ensuring containers stay secure and unaltered throughout their lifecycle. While monitoring and securing container workloads is critical, ensuring the host infrastructure is protected from malware is equally vital for maintaining the security of your containerized environment. To address this, Defender for Cloud is extending the Malware detection for Kubernetes host VMs. Real-time threat detection helps identify potential issues and deviations within your containers; the next critical step is to fully understand the scope and impact of these threats. Think of threat detection as spotting smoke from a fire—it's the first sign something's wrong. But to fully understand the situation and prevent further damage, you need to find the source of the fire and assess its spread. To provide such detailed threat investigation, Defender for Cloud offers a threat analytics report for containers incidents in Defender XDR that helps SOC teams and analysts with extensive information around the potential attack methods that attackers could leverage to infiltrate the containers. It also contains suggestions on how to remediate these threats, and for hunting queries. To facilitate deeper investigation, Cloud process events and investigation queries in Defender XDR,now enable security teams to leverage enriched insights from integrated cloud audit and process event logs. These capabilities help SOC teams trace suspicious activity, analyze control plane and runtime processes, and conduct thorough forensic analysis. Building on this foundation, Defender for Cloud introduces the go hunt action, equipping SOC teams with pre-built, advanced hunting queries tailored to specific clusters. These queries retrieve incident-time data, streamlining investigation so teams can focus on analyzing results and responding to threats efficiently. Together, these capabilities enhance investigation depth, reduce response time, and strengthen overall security resilience. When a containerized environment faces a threat, swift containment is key to protecting critical assets and minimizing downtime. With Defender for Cloud’s new one-click containment Kubernetes response action, security teams can now manually isolate or terminate compromised pods instantly, cutting off unauthorized access and stopping lateral movement within the cluster. This rapid response feature reduces Mean Time to Resolve (MTTR), allowing teams to neutralize threats in real time, safeguard operations, and focus on investigating the root cause—all without complex configurations. Additionally, security teams can leverage AI-driven guided threat remediation with step-by-step assistance, empowering SOC teams to manage container-specific incidents efficiently, even with minimal expertise. New innovations for container threat protection with Microsoft Defender for Cloud Additional container security announcements [General Availability] Containers software inventory: Defender for Cloud now provides a list of software installed in their containers and container images through the Cloud Security Explorer. This list can also be used to quickly gain other insights into the customer environment, such as finding all containers and container images with software impacted by a zero-day vulnerability, even before a CVE is published. [Public Preview] CIS Kubernetes Benchmark: Security teams can leverage multicloud regulatory compliance assessments with support for CIS Kubernetes Benchmarks for Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service, and Google Kubernetes Engine (GKE). [General Availability] Enhanced Kubernetes (K8s) alert documentation and simulation tool: Defender for Cloud’s simulation tool proactively tests Kubernetes (K8s) environment by simulating real-world attack scenarios, causing alerts to be generated. The simulation tool deploys two pods in a target cluster: attacker and victim. During the simulation, the attacker "attacks" the victim using real-world techniques. Stay ahead of container vulnerabilities and attacks with end-to-end protection As containers become central to cloud-native applications, Microsoft Defender for Cloud provides end-to-end security across the entire container lifecycle—enhancing security posture, detecting and responding to threats, and ensuring compliance from development to runtime. As a cloud-native application protection platform (CNAPP), Defender for Cloud empowers everyone from individual developers to SOC analysts and CISOs, providing the precision and depth needed to effectively protect containerized environments from sophisticated threats — setting our approach apart from traditional security methods. To learn more about Defender for Cloud and our new security innovations, you can: Read about the latest posture management security innovations in Defender for Cloud. Check out our cloud security solution page. Learn about our latest releases here. Join us at Ignite. Learn how you can unlock business value with Defender for Cloud. See it in action with a cloud detection and response use-case. Start a 30-day free trial. Source: 1.CNCF Annual Survey 2023 2. Flexera 2024 State of the Cloud ReportMicrosoft Defender for Cloud - strategy and plan towards Log Analytics Agent (MMA) deprecation
Log Analytics agent (also known as MMA) is on a deprecation path and will be retired in Aug 2024. The purpose of this blogpost is to clarify how Microsoft Defender for Cloud will align with this plan and what is the impact on customers.Level Up Your Security Skills with the New Microsoft Sentinel Ninja Training!
If you’ve explored our Microsoft Sentinel Ninja Training in the past, it’s time to revisit! Our training program has undergone some exciting changes to keep you ahead of the curve in the ever-evolving cybersecurity landscape. Microsoft Sentinel is a cutting-edge, cloud-native SIEM and SOAR solution designed to help security professionals protect their organizations from today’s complex threats. Our Ninja Training program is here to guide you through every aspect of this powerful tool. So, what’s new? In addition to the structured security roles format, the Ninja Training now offers a more interactive experience with updated modules, hands-on labs, and real-world scenarios. Whether you're focusing on threat detection, incident response, or automation, the training ensures you gain the practical skills needed to optimize your security operations. One of the biggest updates is the integration of Sentinel into the Defender XDR portal, creating a unified security platform. This merger simplifies workflows, speeds up incident response, and minimizes tool-switching, allowing for seamless operations. Other highlights include: Step-by-step guidance through the official Microsoft Sentinel documentation. Exclusive webinars and up-to-date blog posts from Microsoft experts. If you're ready to take your Sentinel skills to the next level or want to revisit the program’s new features, head over to the blog now and dive into the refreshed Microsoft Sentinel Ninja Training! Don’t miss out—your next cybersecurity breakthrough is just a click away!A Look at Different Options for Storing and Searching Sentinel Archived Logs
As an Azure Sentinel user, you know the importance of having a secure and accessible backup of your log data. In this blog, we'll show you the various options available for storing and searching Sentinel logs beyond the default 90-day retention period. Explore the features and benefits of each solution to find the best fit for your organization.
