> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Microsoft Defender for Cloud for Azure Containers

### More Info:

Ensure that Microsoft Defender for Cloud is enabled for Azure containers.

### Risk Level

High

### Address

Operational Maturity, Security

### Compliance Standards

* CIS AZURE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To enable Microsoft Defender for Cloud for Azure Containers, please follow the below steps:

        1. Go to the Azure portal and log in with your credentials.

        2. Navigate to the "Security Center" from the left-hand side menu.

        3. Click on "Security Center" and then select "Azure Defender" from the top menu.

        4. Click on "Container Security" and then select "On" to enable Microsoft Defender for Cloud for Azure Containers.

        5. Review the pricing tier options and select the one that suits your requirements.

        6. Click on "Save" to apply the changes.

        7. Once the changes are saved, you will see the status change to "Enabled" under the "Azure Defender" dashboard.

        By following these steps, you will have successfully enabled Microsoft Defender for Cloud for Azure Containers.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To enable Microsoft Defender for Cloud for Azure Containers using AZURE CLI, follow these steps:

        1. Open the Azure CLI command prompt and log in to your Azure account.

        2. Run the following command to check if the Azure Defender for Container Registries is enabled:

           ```
           az security atp storage show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
           ```

           Replace `<registry-id>` with the ID of the registry you want to enable Azure Defender for.

        3. If the Azure Defender for Container Registries is not enabled, run the following command to enable it:

           ```
           az security atp storage update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled true
           ```

           Replace `<registry-id>` with the ID of the registry you want to enable Azure Defender for.

        4. Run the following command to check if the Azure Defender for Container Images is enabled:

           ```
           az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
           ```

           Replace `<registry-id>` with the ID of the registry you want to enable Azure Defender for.

        5. If the Azure Defender for Container Images is not enabled, run the following command to enable it:

           ```
           az security atp container update --resource-type Microsoft.Containerregistry/registries --ids <registry-id> --is-enabled true
           ```

           Replace `<registry-id>` with the ID of the registry you want to enable Azure Defender for.

        6. Finally, run the following command to check the status of the Azure Defender for Container Images:

           ```
           az security atp container show --resource-type Microsoft.Containerregistry/registries --ids <registry-id>
           ```

           Replace `<registry-id>` with the ID of the registry you want to check the status for.

        That's it! You have successfully enabled Microsoft Defender for Cloud for Azure Containers using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enable Microsoft Defender for Cloud for Azure Containers using Python, you can follow the below steps:

        Step 1: Install the Azure SDK for Python using the following command:

        ```
        pip install azure-mgmt-containerregistry
        ```

        Step 2: Authenticate with Azure using the following code:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.containerregistry import ContainerRegistryManagementClient

        tenant_id = 'TENANT_ID'
        client_id = 'CLIENT_ID'
        client_secret = 'CLIENT_SECRET'
        subscription_id = 'SUBSCRIPTION_ID'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=client_secret,
            tenant=tenant_id
        )

        client = ContainerRegistryManagementClient(credentials, subscription_id)
        ```

        Step 3: Get the resource group and container registry where you want to enable Microsoft Defender for Cloud. You can use the following code to get the resource group and container registry:

        ```python theme={null}
        resource_group_name = 'RESOURCE_GROUP_NAME'
        registry_name = 'CONTAINER_REGISTRY_NAME'

        registry = client.registries.get(resource_group_name, registry_name)
        ```

        Step 4: Enable Microsoft Defender for Cloud for Azure Containers using the following code:

        ```python theme={null}
        from azure.mgmt.containerregistry.models import RegistryUpdateParameters

        registry_update_params = RegistryUpdateParameters(
            policies=registry.policies,
            storage_account=registry.storage_account,
            identity=registry.identity,
            admin_user_enabled=registry.admin_user_enabled,
            public_network_access_enabled=registry.public_network_access_enabled,
            network_rule_set=registry.network_rule_set,
            encryption=registry.encryption,
            retention_policy=registry.retention_policy,
            trust_policy=registry.trust_policy,
            data_endpoint_enabled=True,
            data_endpoint_dns_name=None
        )

        client.registries.update(resource_group_name, registry_name, registry_update_params)
        ```

        After running the above code, Microsoft Defender for Cloud for Azure Containers will be enabled for the specified container registry.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Enable Microsoft Defender for Cloud (Standard tier) for AKS
        resource "azurerm_security_center_subscription_pricing" "kubernetes_service_defender" {
          resource_type = "KubernetesService"
          tier          = "Standard"
        }

        # Enable Microsoft Defender for Cloud (Standard tier) for Container Registries
        resource "azurerm_security_center_subscription_pricing" "container_registry_defender" {
          resource_type = "ContainerRegistry"
          tier          = "Standard"
        }
        ```

        These changes do not force resource replacement; they update the Defender pricing plan on the subscription.

        Verification: `terraform plan` should show `azurerm_security_center_subscription_pricing.kubernetes_service_defender` and `.container_registry_defender` being created or updated with `tier = "Standard"` and the corresponding `resource_type` values.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>