Skip to content

Commit db00b86

Browse files
asafalgawiasafalgawi
authored
Update subassessment-rest-api.md to include GCP
1 parent 11325ee commit db00b86

File tree

1 file changed

+167
-11
lines changed

1 file changed

+167
-11
lines changed

‎articles/defender-for-cloud/subassessment-rest-api.md

Lines changed: 167 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,14 @@ ms.topic: how-to
1515
Azure Resource Graph (ARG) provides a REST API that can be used to programmatically access vulnerability assessment results for both Azure registry and runtime vulnerabilities recommendations.
1616
Learn more about [ARG references and query examples](/azure/governance/resource-graph/overview).
1717

18-
Azure and AWS container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
18+
Azure, AWS, and GCP container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
1919

2020
## ARG query examples
2121

2222
To pull specific sub assessments, you need the assessment key.
23-
* For Azure container vulnerability assessment powered by MDVM the key is `c0b7cfc6-3172-465a-b378-53c7ff2cc0d5`.
24-
* For AWS container vulnerability assessment powered by MDVM the key is `c27441ae-775c-45be-8ffa-655de37362ce`.
23+
* For Azure container vulnerability assessment powered by MDVM, the key is `c0b7cfc6-3172-465a-b378-53c7ff2cc0d5`.
24+
* For AWS container vulnerability assessment powered by MDVM, the key is `c27441ae-775c-45be-8ffa-655de37362ce`.
25+
* For GCP container vulnerability assessment powered by MDVM, the key is `5cc3a2c1-8397-456f-8792-fe9d0d4c9145`.
2526

2627
The following is a generic security sub assessment query example that can be used as an example to build queries with. This query pulls the first sub assessment generated in the last hour.
2728
```kql
@@ -314,6 +315,161 @@ securityresources
314315
]
315316
```
316317

318+
### Query result - GCP sub-assessment
319+
```json
320+
[
321+
{
322+
"id": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/ microsoft.security/ securityconnectors/{SecurityConnectorName}/securityentitydata/gar-gcp-repository-{RepositoryName}-{Region}/providers/Microsoft.Security/assessments/5cc3a2c1-8397-456f-8792-fe9d0d4c9145/subassessments/{SubAssessmentId}",
323+
"name": "{SubAssessmentId}",
324+
"type": "microsoft.security/assessments/subassessments",
325+
"tenantId": "{TenantId}",
326+
"kind": "",
327+
"location": "global",
328+
"resourceGroup": "{ResourceGroup}",
329+
"subscriptionId": "{SubscriptionId}",
330+
"managedBy": "",
331+
"sku": null,
332+
"plan": null,
333+
"properties": {
334+
"description": "This vulnerability affects the following vendors: Alpine, Debian, Libtiff, Suse, Ubuntu. To view more details about this vulnerability please visit the vendor website.",
335+
"resourceDetails": {
336+
"id": "us-central1-docker.pkg.dev/detection-stg-manual-tests-2/hital/nginx@sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
337+
"source": "Gcp",
338+
"resourceType": "repository",
339+
"nativeCloudUniqueIdentifier": "projects/detection-stg-manual-tests-2/locations/us-central1/repositories/hital/dockerImages/nginx@sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
340+
"resourceProvider": "gar",
341+
"resourceName": "detection-stg-manual-tests-2/hital/nginx",
342+
"hierarchyId": "788875449976",
343+
"connectorId": "40139bd8-5bae-e3e0-c640-2a45cdcd2d0c",
344+
"region": "us-central1"
345+
},
346+
"displayName": "CVE-2017-11613",
347+
"additionalData": {
348+
"assessedResourceType": "GcpContainerRegistryVulnerability",
349+
"vulnerabilityDetails": {
350+
"severity": "Low",
351+
"lastModifiedDate": "2023-12-09T00:00:00.0000000Z",
352+
"exploitabilityAssessment": {
353+
"exploitStepsPublished": false,
354+
"exploitStepsVerified": false,
355+
"exploitUris": [],
356+
"isInExploitKit": false,
357+
"types": [
358+
"PrivilegeEscalation"
359+
]
360+
},
361+
"publishedDate": "2017-07-26T00:00:00.0000000Z",
362+
"workarounds": [],
363+
"references": [
364+
{
365+
"title": "CVE-2017-11613",
366+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2017-11613"
367+
},
368+
{
369+
"title": "129463",
370+
"link": "https://exchange.xforce.ibmcloud.com/vulnerabilities/129463"
371+
},
372+
{
373+
"title": "CVE-2017-11613_oval:com.ubuntu.trusty:def:36061000000",
374+
"link": "https://security-metadata.canonical.com/oval/com.ubuntu.trusty.usn.oval.xml.bz2"
375+
},
376+
{
377+
"title": "CVE-2017-11613_oval:org.debian:def:85994619016140765823174295608399452222",
378+
"link": "https://www.debian.org/security/oval/oval-definitions-stretch.xml"
379+
},
380+
{
381+
"title": "oval:org.opensuse.security:def:201711613",
382+
"link": "https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.server.15.xml.gz"
383+
},
384+
{
385+
"title": "CVE-2017-11613-cpe:2.3:a:alpine:tiff:*:*:*:*:*:alpine_3.9:*:*-3.9",
386+
"link": "https://security.alpinelinux.org/vuln/CVE-2017-11613"
387+
}
388+
],
389+
"weaknesses": {
390+
"cwe": [
391+
{
392+
"id": "CWE-20"
393+
}
394+
]
395+
},
396+
"cvss": {
397+
"2.0": null,
398+
"3.0": {
399+
"cvssVectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R",
400+
"base": 3.3
401+
}
402+
},
403+
"cveId": "CVE-2017-11613",
404+
"cpe": {
405+
"version": "*",
406+
"language": "*",
407+
"vendor": "debian",
408+
"softwareEdition": "*",
409+
"targetSoftware": "debian_9",
410+
"targetHardware": "*",
411+
"product": "tiff",
412+
"edition": "*",
413+
"update": "*",
414+
"other": "*",
415+
"part": "Applications",
416+
"uri": "cpe:2.3:a:debian:tiff:*:*:*:*:*:debian_9:*:*"
417+
}
418+
},
419+
"cvssV30Score": 3.3,
420+
"artifactDetails": {
421+
"lastPushedToRegistryUTC": "2023-12-11T08:33:13.0000000Z",
422+
"repositoryName": "detection-stg-manual-tests-2/hital/nginx",
423+
"registryHost": "us-central1-docker.pkg.dev",
424+
"artifactType": "ContainerImage",
425+
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
426+
"digest": "sha256:09e210fe1e7f54647344d278a8d0dee8a4f59f275b72280e8b5a7c18c560057f",
427+
"tags": [
428+
"1.12"
429+
]
430+
},
431+
"softwareDetails": {
432+
"version": "4.0.8-2+deb9u2",
433+
"language": "",
434+
"fixedVersion": "4.0.8-2+deb9u4",
435+
"vendor": "debian",
436+
"category": "OS",
437+
"osDetails": {
438+
"osPlatform": "linux",
439+
"osVersion": "debian_9"
440+
},
441+
"packageName": "tiff",
442+
"fixReference": {
443+
"description": "DSA-4349-1: tiff security update 2018 November 30",
444+
"id": "DSA-4349-1",
445+
"releaseDate": "2018-11-30T22:41:54.0000000Z",
446+
"url": "https://security-tracker.debian.org/tracker/DSA-4349-1"
447+
},
448+
"fixStatus": "FixAvailable",
449+
"evidence": [
450+
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^tiff:.* -e .*:tiff: | cut -f 1 -d ':' | xargs dpkg-query -s",
451+
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^tiff:.* -e .*:tiff: | cut -f 1 -d ':' | xargs dpkg-query -s"
452+
]
453+
}
454+
},
455+
"timeGenerated": "2023-12-11T10:25:43.8751687Z",
456+
"remediation": "Create new image with updated package tiff with version 4.0.8-2+deb9u4 or higher.",
457+
"id": "CVE-2017-11613",
458+
"status": {
459+
"severity": "Low",
460+
"code": "Unhealthy"
461+
}
462+
},
463+
"tags": null,
464+
"identity": null,
465+
"zones": null,
466+
"extendedLocation": null,
467+
"assessmentKey": "5cc3a2c1-8397-456f-8792-fe9d0d4c9145",
468+
"timeGenerated": "2023-12-11T10:25:43.8751687Z"
469+
}
470+
]
471+
```
472+
317473
## Definitions
318474

319475
| Name | Description |
@@ -340,7 +496,7 @@ Other context fields for Azure container registry vulnerability assessment
340496

341497
| **Name** | **Type** | **Description** |
342498
| -------------------- | -------------------------------------------- | ----------------------------- |
343-
| assessedResourceType | string: <br> AzureContainerRegistryVulnerability<br> AwsContainerRegistryVulnerability | Subassessment resource type |
499+
| assessedResourceType | string: <br> AzureContainerRegistryVulnerability<br> AwsContainerRegistryVulnerability <br> GcpContainerRegistryVulnerability | Subassessment resource type |
344500
| cvssV30Score | Numeric | CVSS V3 Score |
345501
| vulnerabilityDetails | VulnerabilityDetails | |
346502
| artifactDetails | ArtifactDetails | |
@@ -474,21 +630,21 @@ Details of the Azure resource that was assessed
474630
| ID | string | Azure resource ID of the assessed resource |
475631
| source | string: Azure | The platform where the assessed resource resides |
476632

477-
### ResourceDetails - AWS
633+
### ResourceDetails - AWS / GCP
478634

479-
Details of the AWS resource that was assessed
635+
Details of the AWS/GCP resource that was assessed
480636

481637
| **Name** | **Type** | **Description** |
482638
| --------------------------- | --------------- | ------------------------------------------------ |
483639
| id | string | Azure resource ID of the assessed resource |
484-
| source | string: Aws | The platform where the assessed resource resides |
640+
| source | string: Aws/Gcp | The platform where the assessed resource resides |
485641
| connectorId | string | Connector ID |
486642
| region | string | Region |
487643
| nativeCloudUniqueIdentifier | string | Native Cloud's Resource ID of the Assessed resource in |
488-
| resourceProvider | string: ecr | The assessed resource provider |
644+
| resourceProvider | string: ecr/gar/gcr | The assessed resource provider |
489645
| resourceType | string | The assessed resource type |
490646
| resourceName | string | The assessed resource name |
491-
| hierarchyId | string | Account ID (Aws) |
647+
| hierarchyId | string | Account ID (Aws) / Project ID (Gcp) |
492648

493649
### SubAssessmentStatus
494650

@@ -508,7 +664,7 @@ Programmatic code for the status of the assessment
508664
| **Name** | **Type** | **Description**|
509665
| --------------------------- | --------------- | ------------------------------------------------ |
510666
| Healthy | string | The resource is healthy |
511-
| NotApplicable | string | Assessment for this resource did not happen |
667+
| NotApplicable | string | Assessment for this resource didn't happen |
512668
| Unhealthy | string | The resource has a security issue that needs to be addressed |
513669

514670
### SecuritySubAssessment
@@ -526,7 +682,7 @@ Security subassessment on a resource
526682
| properties.id | string | Vulnerability ID |
527683
| properties.impact | string | Description of the impact of this subassessment |
528684
| properties.remediation | string | Information on how to remediate this subassessment |
529-
| properties.resourceDetails | ResourceDetails: <br> [Azure Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---azure) <br> [AWS Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---aws) | Details of the resource that was assessed |
685+
| properties.resourceDetails | ResourceDetails: <br> [Azure Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---azure) <br> [AWS/GCP Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---aws--gcp) | Details of the resource that was assessed |
530686
| properties.status | [SubAssessmentStatus](/azure/defender-for-cloud/subassessment-rest-api#subassessmentstatus) | Status of the subassessment |
531687
| properties.timeGenerated | string | The date and time the subassessment was generated |
532688
| type | string | Resource type |

0 commit comments

Comments
 (0)