Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enable Agentless Container Vulnerability Assessment

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that the Agentless Container Vulnerability Assessment feature is enabled for Microsoft Defender for Cloud in order to improve the security posture of your container images stored in ACR repositories or running within AKS clusters.

Security

The Agentless Container Vulnerability Assessment feature delivers comprehensive vulnerability analysis for Kubernetes node pools and ACR container images. It includes recommendations for both registry and runtime security, near real-time scanning of newly added container images, and daily updates of assessment results. Vulnerability data is integrated into the security graph, enabling contextual risk assessments, attack path calculations, and advanced hunting capabilities.

Note: Agentless Container Vulnerability Assessment is included in the following Microsoft Defender for Cloud plans: Defender CSPM and Containers.

Audit

To determine if Agentless Container Vulnerability Assessment is enabled within the Microsoft Defender for Cloud settings for your Azure subscriptions, perform the following operations:

Note: Getting the configuration status for the Agentless Container Vulnerability Assessment feature in Microsoft Defender for Cloud using Azure CLI/PowerShell is not currently supported.

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to Microsoft Defender for Cloud blade available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0.

03 In the left navigation panel, under Management, choose Environment settings.

04 Choose Expand all under the filtering menu and click on the name (link) of the Azure subscription that you want to examine.

05 In the left navigation panel, under Settings, select Defender plans, and choose Settings and monitoring.

06 On the Settings & monitoring page, ensure that Defender plans is set to All, and check the configuration status of the Registry access component, available in the Status column. If the On/Off toggle button in the Status column is inactive, the Agentless Container Vulnerability Assessment feature is disabled across all the supported Defender plans. If the On/Off toggle button is active and the Status of the Registry access component is set to Off, Agentless Container Vulnerability Assessment is not enabled for Microsoft Defender for Cloud in the selected Azure subscription.

07 Repeat steps no. 4 – 6 for each Azure subscription available within your Microsoft Azure cloud account.

Remediation / Resolution

To enable Agentless Container Vulnerability Assessment within the Microsoft Defender for Cloud settings for your Azure subscriptions, perform the following operations:

Note: Enabling the Agentless Container Vulnerability Assessment feature in Microsoft Defender for Cloud settings using Azure CLI/PowerShell is not currently supported.

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to Microsoft Defender for Cloud blade available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0.

03 In the left navigation panel, under Management, choose Environment settings.

04 Choose Expand all under the filtering menu and click on the name (link) of the Azure subscription that you want to examine.

05 In the left navigation panel, under Settings, select Defender plans, and choose Settings and monitoring.

06 On the Settings & monitoring configuration page, perform the following actions:

  1. Ensure that Defender plans is set to All.
  2. Toggle the On/Off button from the Status column to enable the Registry access component for Microsoft Defender for Cloud in the selected Azure subscription. If the On/Off toggle button is inactive, navigate back to the Defender plans page and enable the required Defender plans (i.e., Defender CSPM and/or Containers).
  3. Select Continue from the top menu to apply the configuration changes.
  4. Choose Save from the top menu to save the changes.

07 Repeat steps no. 4 – 6 for each Azure subscription created within your Microsoft Azure cloud account.

References

Publication date Feb 13, 2025

Related SecurityCenter rules