|
| 1 | +--- |
| 2 | +title: Binary drift detection (preview) |
| 3 | +description: Learn how binary drift detection can help you detect unauthorized external processes within containers. |
| 4 | +ms.topic: how-to |
| 5 | +author: dcurwin |
| 6 | +ms.author: dacurwin |
| 7 | +ms.date: 06/17/2024 |
| 8 | +#customer intent: As a user, I want to understand how binary drift detection can help me detect unauthorized external processes within containers. |
| 9 | +--- |
| 10 | + |
| 11 | +# Binary drift detection (preview) |
| 12 | + |
| 13 | +A binary drift happens when a container is running an executable that didn’t come from the original image. This can either be intentional and legitimate, or it can indicate an attack. Since container images should be immutable, any processes launched from binaries not included in the original image should be evaluated as suspicious activity. |
| 14 | + |
| 15 | +The binary drift detection feature alerts you when there's a difference between the workload that came from the image, and the workload running in the container. It alerts you about potential security threats by detecting unauthorized external processes within containers. You can define drift policies to specify conditions under which alerts should be generated, helping you distinguish between legitimate activities and potential threats. |
| 16 | + |
| 17 | +Binary drift detection is integrated into the Defender for Containers plan and is available in public preview. It's available for the Azure (AKS), Amazon (EKS), and Google (GKE) clouds. |
| 18 | + |
| 19 | +## Prerequisites |
| 20 | + |
| 21 | +- To use binary drift detection, you need to run the Defender for Container sensor, which is available in AWS, GCP, and AKS in [versions](/azure/aks/supported-kubernetes-versions) 1.29 or higher. |
| 22 | +- The Defender for Container sensor must be enabled on the subscriptions and connectors. |
| 23 | +- To create and modify drift policies, you need global admin permissions on the tenant. |
| 24 | + |
| 25 | +## Components |
| 26 | + |
| 27 | +The following components are part of binary drift detection: |
| 28 | + |
| 29 | +- an enhanced sensor capable of detecting binary drift |
| 30 | +- policy configuration options |
| 31 | +- a new binary drift alert |
| 32 | + |
| 33 | +## Configure drift policies |
| 34 | + |
| 35 | +Create drift policies to define when alerts should be generated. Each policy is made up of rules that define the conditions under which alerts should be generated. This allows you to tailor the feature to your specific needs, reducing false positives. You can create exclusions by setting higher priority rules for specific scopes or clusters, images, pods, Kubernetes labels, or namespaces. |
| 36 | + |
| 37 | +To create and configure policies, follow these steps: |
| 38 | + |
| 39 | +1. In Microsoft Defender for Cloud, go to **Environment settings**. Select **Containers drift policy**. |
| 40 | + |
| 41 | + :::image type="content" source="media/binary-drift-detection/select-containers-drift-policy.png" alt-text="Screenshot of Select Containers drift policy in Environment settings." lightbox="media/binary-drift-detection/select-containers-drift-policy.png"::: |
| 42 | + |
| 43 | +1. You receive two rules out of the box: the **Alert on Kube-System namespace** rule and the **Default binary drift** rule. The default rule is a special rule that applies to everything if no other rule before it is matched. You can only modify its action, either to **Drift detection alert** or return it to the default **Ignore drift detection**. The **Alert on Kube-System namespace** rule is an out-of-the-box suggestion and can be modified like any other rule. |
| 44 | + |
| 45 | + :::image type="content" source="media/binary-drift-detection/default-rule.png" alt-text="Screenshot of Default rule appears at the bottom of the list of rules." lightbox="media/binary-drift-detection/default-rule.png"::: |
| 46 | + |
| 47 | +1. To add a new rule, select **Add rule**. A side panel appears where you can configure the rule. |
| 48 | + |
| 49 | + :::image type="content" source="media/binary-drift-detection/add-rule.png" alt-text="Screenshot of Select Add rule to create and configure a new rule." lightbox="media/binary-drift-detection/add-rule.png"::: |
| 50 | + |
| 51 | +1. To configure the rule, define the following fields: |
| 52 | + |
| 53 | + - **Rule name**: A descriptive name for the rule. |
| 54 | + - **Action**: Select **Drift detection alert** if the rule should generate an alert or **Ignore drift detection** to exclude it from alert generation. |
| 55 | + - **Scope description**: A description of the scope to which the rule applies. |
| 56 | + - **Cloud scope**: The cloud provider to which the rule applies. You can choose any combination of Azure, AWS, or GCP. If you expand a cloud provider, you can select specific subscription. If you don't select the entire cloud provider, new subscriptions added to the cloud provider won't be included in the rule. |
| 57 | + - **Resource scope**: Here you can add conditions based on the following categories: **Container name**, **Image name**, **Namespace**, **Pod labels**, **Pod name**, or **Cluster name**. Then choose an operator: **Starts with**, **Ends with**, **Equals**, or **Contains**. Finally, enter the value to match. You can add as many conditions as needed by selecting **+Add condition**. |
| 58 | + - **Allow list for processes**: A list of processes that are allowed to run in the container. If a process not on this list is detected, an alert is generated. |
| 59 | + |
| 60 | + Here's an example of a rule that allows the `dev1.exe` process to run in containers in the Azure cloud scope, whose image names start with either *Test123* or *env123*: |
| 61 | + |
| 62 | + :::image type="content" source="media/binary-drift-detection/rule-configuration.png" alt-text="Example of a rule configuration with all the fields defined." lightbox="media/binary-drift-detection/rule-configuration.png"::: |
| 63 | + |
| 64 | +1. Select **Apply** to save the rule. |
| 65 | + |
| 66 | +1. Once you configure your rule, select and drag the rule up or down on the list to change its priority. The rule with the highest priority is evaluated first. If there's a match, it either generates an alert or ignores it (based on what was chosen for that rule) and the evaluation stops. If no match is found, the next rule is evaluated. If there's no match for any rule, the default rule is applied. |
| 67 | + |
| 68 | +1. To edit an existing rule, choose the rule and select **Edit**. This opens the side panel where you can make changes to the rule. |
| 69 | + |
| 70 | +1. You can select **Duplicate rule** to create a copy of a rule. This can be useful if you want to create a similar rule with only minor changes. |
| 71 | + |
| 72 | +1. To delete a rule, select **Delete rule**. |
| 73 | + |
| 74 | +1. After you configured your rules, select **Save** to apply the changes and create the policy. |
| 75 | +1. Within 30 minutes, the sensors on the protected clusters are updated with the new policy. |
| 76 | + |
| 77 | +## Monitor and manage alerts |
| 78 | + |
| 79 | +The alert system is designed to notify you of any binary drifts, helping you maintain the integrity of your container images. If an unauthorized external process is detected that matches your defined policy conditions, an alert with high severity is generated for you to review. |
| 80 | + |
| 81 | +## Adjust policies as needed |
| 82 | + |
| 83 | +Based on the alerts you receive and your review of them, you might find it necessary to adjust your rules in the binary drift policy. This could involve refining conditions, adding new rules, or removing ones that generate too many false positives. The goal is to ensure that the defined binary drift policies with their rules effectively balance security needs with operational efficiency. |
| 84 | + |
| 85 | +The effectiveness of binary drift detection relies on your active engagement in configuring, monitoring, and adjusting policies to suit your environment's unique requirements. |
| 86 | + |
| 87 | +## Related content |
| 88 | + |
| 89 | +- [Overview of Container security in Microsoft Defender for Containers](defender-for-containers-introduction.md) |
0 commit comments