Skip to content

Commit 4dc32de

Browse files
asafalgawiasafalgawi
authored
Update subassessment-rest-api.md
1 parent f74c077 commit 4dc32de

File tree

1 file changed

+8
-164
lines changed

1 file changed

+8
-164
lines changed

‎articles/defender-for-cloud/subassessment-rest-api.md

Lines changed: 8 additions & 164 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,13 @@ ms.topic: how-to
1515
Azure Resource Graph (ARG) provides a REST API that can be used to programmatically access vulnerability assessment results for both Azure registry and runtime vulnerabilities recommendations.
1616
Learn more about [ARG references and query examples](/azure/governance/resource-graph/overview).
1717

18-
Azure, AWS, and GCP container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
18+
Azure and AWS container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
1919

2020
## ARG query examples
2121

2222
To pull specific sub assessments, you need the assessment key.
2323
* For Azure container vulnerability assessment powered by MDVM the key is `c0b7cfc6-3172-465a-b378-53c7ff2cc0d5`.
2424
* For AWS container vulnerability assessment powered by MDVM the key is `c27441ae-775c-45be-8ffa-655de37362ce`.
25-
* For GCP container vulnerability assessment powered by MDVM the key is `5cc3a2c1-8397-456f-8792-fe9d0d4c9145`.
2625

2726
The following is a generic security sub assessment query example that can be used as an example to build queries with. This query pulls the first sub assessment generated in the last hour.
2827
```kql
@@ -315,161 +314,6 @@ securityresources
315314
]
316315
```
317316

318-
### Query result - GCP sub-assessment
319-
```json
320-
[
321-
{
322-
"id": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/ microsoft.security/ securityconnectors/{SecurityConnectorName}/securityentitydata/gar-gcp-repository-{RepositoryName}-{Region}/providers/Microsoft.Security/assessments/5cc3a2c1-8397-456f-8792-fe9d0d4c9145/subassessments/{SubAssessmentId}",
323-
"name": "{SubAssessmentId}",
324-
"type": "microsoft.security/assessments/subassessments",
325-
"tenantId": "{TenantId}",
326-
"kind": "",
327-
"location": "global",
328-
"resourceGroup": "{ResourceGroup}",
329-
"subscriptionId": "{SubscriptionId}",
330-
"managedBy": "",
331-
"sku": null,
332-
"plan": null,
333-
"properties": {
334-
"description": "This vulnerability affects the following vendors: Alpine, Debian, Libtiff, Suse, Ubuntu. To view more details about this vulnerability please visit the vendor website.",
335-
"resourceDetails": {
336-
"id": "us-central1-docker.pkg.dev/detection-stg-manual-tests-2/hital/nginx@sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
337-
"source": "Gcp",
338-
"resourceType": "repository",
339-
"nativeCloudUniqueIdentifier": "projects/detection-stg-manual-tests-2/locations/us-central1/repositories/hital/dockerImages/nginx@sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
340-
"resourceProvider": "gar",
341-
"resourceName": "detection-stg-manual-tests-2/hital/nginx",
342-
"hierarchyId": "788875449976",
343-
"connectorId": "40139bd8-5bae-e3e0-c640-2a45cdcd2d0c",
344-
"region": "us-central1"
345-
},
346-
"displayName": "CVE-2017-11613",
347-
"additionalData": {
348-
"assessedResourceType": "GcpContainerRegistryVulnerability",
349-
"vulnerabilityDetails": {
350-
"severity": "Low",
351-
"lastModifiedDate": "2023-12-09T00:00:00.0000000Z",
352-
"exploitabilityAssessment": {
353-
"exploitStepsPublished": false,
354-
"exploitStepsVerified": false,
355-
"exploitUris": [],
356-
"isInExploitKit": false,
357-
"types": [
358-
"PrivilegeEscalation"
359-
]
360-
},
361-
"publishedDate": "2017-07-26T00:00:00.0000000Z",
362-
"workarounds": [],
363-
"references": [
364-
{
365-
"title": "CVE-2017-11613",
366-
"link": "https://nvd.nist.gov/vuln/detail/CVE-2017-11613"
367-
},
368-
{
369-
"title": "129463",
370-
"link": "https://exchange.xforce.ibmcloud.com/vulnerabilities/129463"
371-
},
372-
{
373-
"title": "CVE-2017-11613_oval:com.ubuntu.trusty:def:36061000000",
374-
"link": "https://security-metadata.canonical.com/oval/com.ubuntu.trusty.usn.oval.xml.bz2"
375-
},
376-
{
377-
"title": "CVE-2017-11613_oval:org.debian:def:85994619016140765823174295608399452222",
378-
"link": "https://www.debian.org/security/oval/oval-definitions-stretch.xml"
379-
},
380-
{
381-
"title": "oval:org.opensuse.security:def:201711613",
382-
"link": "https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.server.15.xml.gz"
383-
},
384-
{
385-
"title": "CVE-2017-11613-cpe:2.3:a:alpine:tiff:*:*:*:*:*:alpine_3.9:*:*-3.9",
386-
"link": "https://security.alpinelinux.org/vuln/CVE-2017-11613"
387-
}
388-
],
389-
"weaknesses": {
390-
"cwe": [
391-
{
392-
"id": "CWE-20"
393-
}
394-
]
395-
},
396-
"cvss": {
397-
"2.0": null,
398-
"3.0": {
399-
"cvssVectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R",
400-
"base": 3.3
401-
}
402-
},
403-
"cveId": "CVE-2017-11613",
404-
"cpe": {
405-
"version": "*",
406-
"language": "*",
407-
"vendor": "debian",
408-
"softwareEdition": "*",
409-
"targetSoftware": "debian_9",
410-
"targetHardware": "*",
411-
"product": "tiff",
412-
"edition": "*",
413-
"update": "*",
414-
"other": "*",
415-
"part": "Applications",
416-
"uri": "cpe:2.3:a:debian:tiff:*:*:*:*:*:debian_9:*:*"
417-
}
418-
},
419-
"cvssV30Score": 3.3,
420-
"artifactDetails": {
421-
"lastPushedToRegistryUTC": "2023-12-11T08:33:13.0000000Z",
422-
"repositoryName": "detection-stg-manual-tests-2/hital/nginx",
423-
"registryHost": "us-central1-docker.pkg.dev",
424-
"artifactType": "ContainerImage",
425-
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
426-
"digest": "sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
427-
"tags": [
428-
"1.12"
429-
]
430-
},
431-
"softwareDetails": {
432-
"version": "4.0.8-2+deb9u2",
433-
"language": "",
434-
"fixedVersion": "4.0.8-2+deb9u4",
435-
"vendor": "debian",
436-
"category": "OS",
437-
"osDetails": {
438-
"osPlatform": "linux",
439-
"osVersion": "debian_9"
440-
},
441-
"packageName": "tiff",
442-
"fixReference": {
443-
"description": "DSA-4349-1: tiff security update 2018 November 30",
444-
"id": "DSA-4349-1",
445-
"releaseDate": "2018-11-30T22:41:54.0000000Z",
446-
"url": "https://security-tracker.debian.org/tracker/DSA-4349-1"
447-
},
448-
"fixStatus": "FixAvailable",
449-
"evidence": [
450-
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^tiff:.* -e .*:tiff: | cut -f 1 -d ':' | xargs dpkg-query -s",
451-
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^tiff:.* -e .*:tiff: | cut -f 1 -d ':' | xargs dpkg-query -s"
452-
]
453-
}
454-
},
455-
"timeGenerated": "2023-12-11T10:25:43.8751687Z",
456-
"remediation": "Create new image with updated package tiff with version 4.0.8-2+deb9u4 or higher.",
457-
"id": "CVE-2017-11613",
458-
"status": {
459-
"severity": "Low",
460-
"code": "Unhealthy"
461-
}
462-
},
463-
"tags": null,
464-
"identity": null,
465-
"zones": null,
466-
"extendedLocation": null,
467-
"assessmentKey": "5cc3a2c1-8397-456f-8792-fe9d0d4c9145",
468-
"timeGenerated": "2023-12-11T10:25:43.8751687Z"
469-
}
470-
]
471-
```
472-
473317
## Definitions
474318

475319
| Name | Description |
@@ -496,7 +340,7 @@ Other context fields for Azure container registry vulnerability assessment
496340

497341
| **Name** | **Type** | **Description** |
498342
| -------------------- | -------------------------------------------- | ----------------------------- |
499-
| assessedResourceType | string: <br> AzureContainerRegistryVulnerability<br> AwsContainerRegistryVulnerability <br> GcpContainerRegistryVulnerability | Subassessment resource type |
343+
| assessedResourceType | string: <br> AzureContainerRegistryVulnerability<br> AwsContainerRegistryVulnerability | Subassessment resource type |
500344
| cvssV30Score | Numeric | CVSS V3 Score |
501345
| vulnerabilityDetails | VulnerabilityDetails | |
502346
| artifactDetails | ArtifactDetails | |
@@ -630,21 +474,21 @@ Details of the Azure resource that was assessed
630474
| ID | string | Azure resource ID of the assessed resource |
631475
| source | string: Azure | The platform where the assessed resource resides |
632476

633-
### ResourceDetails - AWS / GCP
477+
### ResourceDetails - AWS
634478

635-
Details of the AWS/GCP resource that was assessed
479+
Details of the AWS resource that was assessed
636480

637481
| **Name** | **Type** | **Description** |
638482
| --------------------------- | --------------- | ------------------------------------------------ |
639483
| id | string | Azure resource ID of the assessed resource |
640-
| source | string: Aws/Gcp | The platform where the assessed resource resides |
484+
| source | string: Aws | The platform where the assessed resource resides |
641485
| connectorId | string | Connector ID |
642486
| region | string | Region |
643487
| nativeCloudUniqueIdentifier | string | Native Cloud's Resource ID of the Assessed resource in |
644-
| resourceProvider | string: ecr/gar | The assessed resource provider |
488+
| resourceProvider | string: ecr | The assessed resource provider |
645489
| resourceType | string | The assessed resource type |
646490
| resourceName | string | The assessed resource name |
647-
| hierarchyId | string | Account ID (Aws) / Project ID (Gcp) |
491+
| hierarchyId | string | Account ID (Aws) |
648492

649493
### SubAssessmentStatus
650494

@@ -682,7 +526,7 @@ Security subassessment on a resource
682526
| properties.id | string | Vulnerability ID |
683527
| properties.impact | string | Description of the impact of this subassessment |
684528
| properties.remediation | string | Information on how to remediate this subassessment |
685-
| properties.resourceDetails | ResourceDetails: <br> [Azure Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---azure) <br> [AWS/GCP Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---aws--gcp) | Details of the resource that was assessed |
529+
| properties.resourceDetails | ResourceDetails: <br> [Azure Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---azure) <br> [AWS Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---aws) | Details of the resource that was assessed |
686530
| properties.status | [SubAssessmentStatus](/azure/defender-for-cloud/subassessment-rest-api#subassessmentstatus) | Status of the subassessment |
687531
| properties.timeGenerated | string | The date and time the subassessment was generated |
688532
| type | string | Resource type |

0 commit comments

Comments
 (0)