|
1 | 1 | --- |
2 | | -title: Manage secrets with agentless secret scanning (preview) |
| 2 | +title: Manage secrets with agentless secret scanning |
3 | 3 | description: Learn how to scan your servers for secrets with Defender for Server's agentless secret scanning. |
4 | 4 | ms.topic: overview |
5 | | -ms.date: 08/15/2023 |
| 5 | +ms.date: 11/27/2023 |
6 | 6 | --- |
7 | 7 |
|
8 | | -# Manage secrets with agentless secret scanning (preview) |
| 8 | +# Manage secrets with agentless secret scanning |
9 | 9 |
|
10 | 10 | Attackers can move laterally across networks, find sensitive data, and exploit vulnerabilities to damage critical information systems by accessing internet-facing workloads and exploiting exposed credentials and secrets. |
11 | 11 |
|
12 | 12 | Defender for Cloud's agentless secret scanning for Virtual Machines (VM) locates plaintext secrets that exist in your environment. If secrets are detected, Defender for Cloud can assist your security team to prioritize and take actionable remediation steps to minimize the risk of lateral movement, all without affecting your machine's performance. |
13 | 13 |
|
14 | | -By using agentless secret scanning, you can proactively discover the following types of secrets across your environments: |
15 | | - |
16 | | -- **Insecure SSH private keys (Azure, AWS, GCP)** - supports RSA algorithm for PuTTy files, PKCS#8 and PKCS#1 standards |
17 | | -- **Plaintext Azure SQL connection strings (Azure, AWS)** - supports SQL PAAS |
18 | | -- **Plaintext Azure storage account connection strings (Azure, AWS)** |
19 | | -- **Plaintext Azure storage account SAS tokens (Azure, AWS)** |
20 | | -- **Plaintext AWS access keys (Azure, AWS)** |
21 | | -- **Plaintext AWS RDS SQL connection string (Azure, AWS)** -supports SQL PAAS |
22 | | - |
23 | | -In addition to detecting SSH private keys, the agentless scanner verifies whether they can be used to move laterally in the network. Keys that we didn't successfully verify are categorized as **unverified** in the **Recommendation** pane. |
| 14 | +By using agentless secret scanning, you can proactively discover the following types of secrets across your environments (in Azure, AWS and GCP cloud providers): |
| 15 | + |
| 16 | +- Insecure SSH private keys: |
| 17 | + - Supports RSA algorithm for PuTTy files. |
| 18 | + - PKCS#8 and PKCS#1 standards. |
| 19 | + - OpenSSH standard. |
| 20 | +- Plaintext Azure SQL connection strings, supports SQL PAAS. |
| 21 | +- Plaintext Azure database for PostgreSQL. |
| 22 | +- Plaintext Azure database for MySQL. |
| 23 | +- Plaintext Azure database for MariaDB. |
| 24 | +- Plaintext Azure Cosmos DB, including PostgreSQL, MySQL and MariaDB. |
| 25 | +- Plaintext AWS RDS connection string, supports SQL PAAS: |
| 26 | + - Plaintext Amazon Aurora with Postgres and MySQL flavors. |
| 27 | + - Plaintext Amazon custom RDS with Oracle and SQL Server flavors. |
| 28 | +- Plaintext Azure storage account connection strings. |
| 29 | +- Plaintext Azure storage account SAS tokens. |
| 30 | +- Plaintext AWS access keys. |
| 31 | +- Plaintext AWS S3 pre-signed URL. |
| 32 | +- Plaintext Google storage signed URL. |
| 33 | +- Plaintext Azure AD Client Secret. |
| 34 | +- Plaintext Azure DevOps Personal Access Token. |
| 35 | +- Plaintext GitHub Personal Access Token. |
| 36 | +- Plaintext Azure App Configuration Access Key. |
| 37 | +- Plaintext Azure Cognitive Service Key. |
| 38 | +- Plaintext Azure AD User Credentials. |
| 39 | +- Plaintext Azure Container Registry Access Key. |
| 40 | +- Plaintext Azure App Service Deployment Password. |
| 41 | +- Plaintext Azure Databricks Personal Access Token. |
| 42 | +- Plaintext Azure SignalR Access Key. |
| 43 | +- Plaintext Azure API Management Subscription Key. |
| 44 | +- Plaintext Azure Bot Framework Secret Key. |
| 45 | +- Plaintext Azure Machine Learning Web Service API Key. |
| 46 | +- Plaintext Azure Communication Services Access Key. |
| 47 | +- Plaintext Azure EventGrid Access Key. |
| 48 | +- Plaintext Amazon Marketplace Web Service (MWS) Access Key. |
| 49 | +- Plaintext Azure Maps Subscription Key. |
| 50 | +- Plaintext Azure Web PubSub Access Key. |
| 51 | +- Plaintext OpenAI API Key. |
| 52 | +- Plaintext Azure Batch Shared Access Key. |
| 53 | +- Plaintext NPM Author Token. |
| 54 | +- Plaintext Azure Subscription Management Certificate. |
| 55 | + |
| 56 | +Secret findings can be found using the [Cloud Security Explorer](#remediate-secrets-with-cloud-security-explorer) and the [Secrets tab](#remediate-secrets-from-your-asset-inventory) with their metadata like secret type, file name, file path, last access time, and more. |
| 57 | + |
| 58 | +The following secrets can also be accessed from the `Security Recommendations` and `Attack Path`, across Azure, AWS and GCP cloud providers: |
| 59 | + |
| 60 | +- Insecure SSH private keys: |
| 61 | + - Supporting RSA algorithm for PuTTy files. |
| 62 | + - PKCS#8 and PKCS#1 standards. |
| 63 | + - OpenSSH standard. |
| 64 | +- Plaintext Azure database connection string: |
| 65 | + - Plaintext Azure SQL connection strings, supports SQL PAAS. |
| 66 | + - Plaintext Azure database for PostgreSQL. |
| 67 | + - Plaintext Azure database for MySQL. |
| 68 | + - Plaintext Azure database for MariaDB. |
| 69 | + - Plaintext Azure Cosmos DB, including PostgreSQL, MySQL and MariaDB. |
| 70 | +- Plaintext AWS RDS connection string, supports SQL PAAS: |
| 71 | + - Plaintext Amazon Aurora with Postgres and MySQL flavors. |
| 72 | + - Plaintext Amazon custom RDS with Oracle and SQL Server flavors. |
| 73 | +- Plaintext Azure storage account connection strings. |
| 74 | +- Plaintext Azure storage account SAS tokens. |
| 75 | +- Plaintext AWS access keys. |
| 76 | +- Plaintext AWS S3 pre-signed URL. |
| 77 | +- Plaintext Google storage signed URL. |
| 78 | + |
| 79 | +The agentless scanner verifies whether SSH private keys can be used to move laterally in your network. Keys that aren't successfully verified are categorized as `unverified` on the Recommendation page. |
24 | 80 |
|
25 | 81 | ## Prerequisites |
26 | 82 |
|
|
0 commit comments