Skip to content

Commit e6d0921

Browse files
v-ccolinv-ccolin
authored
Merge pull request #260828 from AsafAlgawi-MSFT/main
Add support for multicloud data in subassessment
2 parents b2094b3 + 4dc32de commit e6d0921

File tree

1 file changed

+200
-12
lines changed

1 file changed

+200
-12
lines changed

‎articles/defender-for-cloud/subassessment-rest-api.md

Lines changed: 200 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,16 @@ ms.topic: how-to
1212

1313
## Overview
1414

15-
Azure Resource Graph (ARG) provides a REST API that can be used to pragmatically access vulnerability assessment results for both Azure registry and runtime vulnerabilities recommendations.
15+
Azure Resource Graph (ARG) provides a REST API that can be used to programmatically access vulnerability assessment results for both Azure registry and runtime vulnerabilities recommendations.
1616
Learn more about [ARG references and query examples](/azure/governance/resource-graph/overview).
1717

18-
Azure container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
18+
Azure and AWS container registry vulnerabilities sub-assessments are published to ARG as part of the security resources. Learn more about [security sub-assessments](/azure/governance/resource-graph/samples/samples-by-category?tabs=azure-cli#list-container-registry-vulnerability-assessment-results).
1919

2020
## ARG query examples
2121

22-
To pull specific sub assessments, you need the assessment key. For Container vulnerability assessment powered by MDVM the key is `c0b7cfc6-3172-465a-b378-53c7ff2cc0d5`.
22+
To pull specific sub assessments, you need the assessment key.
23+
* For Azure container vulnerability assessment powered by MDVM the key is `c0b7cfc6-3172-465a-b378-53c7ff2cc0d5`.
24+
* For AWS container vulnerability assessment powered by MDVM the key is `c27441ae-775c-45be-8ffa-655de37362ce`.
2325

2426
The following is a generic security sub assessment query example that can be used as an example to build queries with. This query pulls the first sub assessment generated in the last hour.
2527
```kql
@@ -30,7 +32,7 @@ securityresources
3032
| extend timeGenerated = properties.timeGenerated
3133
| where timeGenerated > ago(1h)
3234
```
33-
### Query result
35+
### Query result - Azure sub-assessment
3436
```json
3537
[
3638
{
@@ -163,12 +165,161 @@ securityresources
163165
]
164166
```
165167

168+
### Query result - AWS sub-assessment
169+
```json
170+
[
171+
{
172+
"id": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/ microsoft.security/ securityconnectors/{SecurityConnectorName}/ securityentitydata/aws-ecr-repository-{RepositoryName}-{Region}/providers/Microsoft.Security/assessments/c27441ae-775c-45be-8ffa-655de37362ce/subassessments/{SubAssessmentId}",
173+
"name": "{SubAssessmentId}",
174+
"type": "microsoft.security/assessments/subassessments",
175+
"tenantId": "{TenantId}",
176+
"kind": "",
177+
"location": "global",
178+
"resourceGroup": "{ResourceGroup}",
179+
"subscriptionId": "{SubscriptionId}",
180+
"managedBy": "",
181+
"sku": null,
182+
"plan": null,
183+
"properties": {
184+
"description": "This vulnerability affects the following vendors: Debian, Fedora, Luatex_Project, Miktex, Oracle, Suse, Tug, Ubuntu. To view more details about this vulnerability please visit the vendor website.",
185+
"resourceDetails": {
186+
"id": "544047870946.dkr.ecr.us-east-1.amazonaws.com/mc/va/eastus/verybigimage@sha256:87e18285c301bc09b7f2da126992475eb0c536d38272aa0a7066324b7dda3d87",
187+
"source": "Aws",
188+
"connectorId": "649e5f3a-ea19-4057-88fd-58b1f4b774e2",
189+
"region": "us-east-1",
190+
"nativeCloudUniqueIdentifier": "arn:aws:ecr:us-east-1:544047870946:image/mc/va/eastus/verybigimage",
191+
"resourceProvider": "ecr",
192+
"resourceType": "repository",
193+
"resourceName": "mc/va/eastus/verybigimage",
194+
"hierarchyId": "544047870946"
195+
},
196+
"additionalData": {
197+
"assessedResourceType": "AwsContainerRegistryVulnerability",
198+
"cvssV30Score": 7.8,
199+
"vulnerabilityDetails": {
200+
"severity": "High",
201+
"exploitabilityAssessment": {
202+
"exploitStepsPublished": false,
203+
"exploitStepsVerified": false,
204+
"isInExploitKit": false,
205+
"exploitUris": [],
206+
"types": []
207+
},
208+
"lastModifiedDate": "2023-11-07T00:00:00.0000000Z",
209+
"publishedDate": "2023-05-16T00:00:00.0000000Z",
210+
"workarounds": [],
211+
"weaknesses": {
212+
"cwe": []
213+
},
214+
"references": [
215+
{
216+
"title": "CVE-2023-32700",
217+
"link": "https://nvd.nist.gov/vuln/detail/CVE-2023-32700"
218+
},
219+
{
220+
"title": "CVE-2023-32700_oval:com.oracle.elsa:def:20233661",
221+
"link": "https://linux.oracle.com/security/oval/com.oracle.elsa-all.xml.bz2"
222+
},
223+
{
224+
"title": "CVE-2023-32700_oval:com.ubuntu.bionic:def:61151000000",
225+
"link": "https://security-metadata.canonical.com/oval/com.ubuntu.bionic.usn.oval.xml.bz2"
226+
},
227+
{
228+
"title": "CVE-2023-32700_oval:org.debian:def:155787957530144107267311766002078821941",
229+
"link": "https://www.debian.org/security/oval/oval-definitions-bullseye.xml"
230+
},
231+
{
232+
"title": "oval:org.opensuse.security:def:202332700",
233+
"link": "https://ftp.suse.com/pub/projects/security/oval/suse.linux.enterprise.server.15.xml.gz"
234+
},
235+
{
236+
"title": "texlive-base-20220321-72.fc38",
237+
"link": "https://archives.fedoraproject.org/pub/fedora/linux/updates/38/Everything/x86_64/repodata/c7921a40ea935e92e8cfe8f4f0062fbc3a8b55bc01eaf0e5cfc196d51ebab20d-updateinfo.xml.xz"
238+
}
239+
],
240+
"cvss": {
241+
"2.0": null,
242+
"3.0": {
243+
"cvssVectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
244+
"base": 7.8
245+
}
246+
},
247+
"cveId": "CVE-2023-32700",
248+
"cpe": {
249+
"language": "*",
250+
"softwareEdition": "*",
251+
"version": "*",
252+
"targetSoftware": "ubuntu_linux_20.04",
253+
"targetHardware": "*",
254+
"vendor": "ubuntu",
255+
"edition": "*",
256+
"product": "libptexenc1",
257+
"update": "*",
258+
"other": "*",
259+
"part": "Applications",
260+
"uri": "cpe:2.3:a:ubuntu:libptexenc1:*:*:*:*:*:ubuntu_linux_20.04:*:*"
261+
}
262+
},
263+
"artifactDetails": {
264+
"repositoryName": "mc/va/eastus/verybigimage",
265+
"registryHost": "544047870946.dkr.ecr.us-east-1.amazonaws.com",
266+
"lastPushedToRegistryUTC": "2022-06-26T13:24:03.0000000Z",
267+
"artifactType": "ContainerImage",
268+
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
269+
"digest": "sha256:87e18285c301bc09b7f2da126992475eb0c536d38272aa0a7066324b7dda3d87",
270+
"tags": [
271+
"latest"
272+
]
273+
},
274+
"softwareDetails": {
275+
"fixedVersion": "2019.20190605.51237-3ubuntu0.1",
276+
"language": "",
277+
"category": "OS",
278+
"osDetails": {
279+
"osPlatform": "linux",
280+
"osVersion": "ubuntu_linux_20.04"
281+
},
282+
"version": "2019.20190605.51237-3build2",
283+
"vendor": "ubuntu",
284+
"packageName": "libptexenc1",
285+
"fixStatus": "FixAvailable",
286+
"evidence": [
287+
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^libptexenc1:.* -e .*:libptexenc1: | cut -f 1 -d ':' | xargs dpkg-query -s",
288+
"dpkg-query -f '${Package}:${Source}:\\n' -W | grep -e ^libptexenc1:.* -e .*:libptexenc1: | cut -f 1 -d ':' | xargs dpkg-query -s"
289+
],
290+
"fixReference": {
291+
"description": "USN-6115-1: TeX Live vulnerability 2023 May 30",
292+
"id": "USN-6115-1",
293+
"releaseDate": "2023-05-30T00:00:00.0000000Z",
294+
"url": "https://ubuntu.com/security/notices/USN-6115-1"
295+
}
296+
}
297+
},
298+
"timeGenerated": "2023-12-11T13:23:58.4539977Z",
299+
"displayName": "CVE-2023-32700",
300+
"remediation": "Create new image with updated package libptexenc1 with version 2019.20190605.51237-3ubuntu0.1 or higher.",
301+
"status": {
302+
"severity": "High",
303+
"code": "Unhealthy"
304+
},
305+
"id": "CVE-2023-32700"
306+
},
307+
"tags": null,
308+
"identity": null,
309+
"zones": null,
310+
"extendedLocation": null,
311+
"assessmentKey": "c27441ae-775c-45be-8ffa-655de37362ce",
312+
"timeGenerated": "2023-12-11T13:23:58.4539977Z"
313+
}
314+
]
315+
```
316+
166317
## Definitions
167318

168319
| Name | Description |
169320
| --------------------------- | ------------------------------------------------------------ |
170-
| AzureResourceDetails | Details of the Azure resource that was assessed |
171-
| AzureContainerVulnerability | More context fields for container registry Vulnerability assessment |
321+
| ResourceDetails | Details of the Azure resource that was assessed |
322+
| ContainerRegistryVulnerability | More context fields for container registry vulnerability assessment |
172323
| CVE | CVE Details |
173324
| CVSS | CVSS Details |
174325
| SecuritySubAssessment | Security subassessment on a resource |
@@ -183,13 +334,13 @@ securityresources
183334
| VulnerabilityReference | Reference links to vulnerability |
184335
| ExploitabilityAssessment | Reference links to an example exploit |
185336

186-
### AzureContainerRegistryVulnerability (MDVM)
337+
### ContainerRegistryVulnerability (MDVM)
187338

188339
Other context fields for Azure container registry vulnerability assessment
189340

190341
| **Name** | **Type** | **Description** |
191342
| -------------------- | -------------------------------------------- | ----------------------------- |
192-
| assessedResourceType | string: AzureContainerRegistryVulnerability | Subassessment resource type |
343+
| assessedResourceType | string: <br> AzureContainerRegistryVulnerability<br> AwsContainerRegistryVulnerability | Subassessment resource type |
193344
| cvssV30Score | Numeric | CVSS V3 Score |
194345
| vulnerabilityDetails | VulnerabilityDetails | |
195346
| artifactDetails | ArtifactDetails | |
@@ -202,7 +353,7 @@ Context details for the affected container image
202353
| **Name** | **Type** | **Description** |
203354
| -------------------------- | ----------------------- | ------------------------------------ |
204355
| repositoryName | String | Repository name |
205-
| RepositoryHost | String | Repository host |
356+
| RegistryHost | String | Registry host |
206357
| lastPublishedToRegistryUTC | Timestamp | UTC timestamp for last publish date |
207358
| artifactType | String: ContainerImage | |
208359
| mediaType | String | Layer media type |
@@ -314,7 +465,7 @@ Reference links to an example exploit
314465
| isInExploitKit | Boolean | Is part of the exploit kit |
315466
| types | String | Exploit types, for example: NotAvailable, Dos, Local, Remote, WebApps, PrivilegeEscalation |
316467

317-
### AzureResourceDetails
468+
### ResourceDetails - Azure
318469

319470
Details of the Azure resource that was assessed
320471

@@ -323,6 +474,43 @@ Details of the Azure resource that was assessed
323474
| ID | string | Azure resource ID of the assessed resource |
324475
| source | string: Azure | The platform where the assessed resource resides |
325476

477+
### ResourceDetails - AWS
478+
479+
Details of the AWS resource that was assessed
480+
481+
| **Name** | **Type** | **Description** |
482+
| --------------------------- | --------------- | ------------------------------------------------ |
483+
| id | string | Azure resource ID of the assessed resource |
484+
| source | string: Aws | The platform where the assessed resource resides |
485+
| connectorId | string | Connector ID |
486+
| region | string | Region |
487+
| nativeCloudUniqueIdentifier | string | Native Cloud's Resource ID of the Assessed resource in |
488+
| resourceProvider | string: ecr | The assessed resource provider |
489+
| resourceType | string | The assessed resource type |
490+
| resourceName | string | The assessed resource name |
491+
| hierarchyId | string | Account ID (Aws) |
492+
493+
### SubAssessmentStatus
494+
495+
Status of the sub-assessment
496+
497+
| **Name** | **Type** | **Description**|
498+
| --------------------------- | --------------- | ------------------------------------------------ |
499+
| cause | String | Programmatic code for the cause of the assessment status |
500+
| code | SubAssessmentStatusCode | Programmatic code for the status of the assessment
501+
| description | string | Human readable description of the assessment status |
502+
| severity | severity | The sub-assessment severity level |
503+
504+
### SubAssessmentStatusCode
505+
506+
Programmatic code for the status of the assessment
507+
508+
| **Name** | **Type** | **Description**|
509+
| --------------------------- | --------------- | ------------------------------------------------ |
510+
| Healthy | string | The resource is healthy |
511+
| NotApplicable | string | Assessment for this resource did not happen |
512+
| Unhealthy | string | The resource has a security issue that needs to be addressed |
513+
326514
### SecuritySubAssessment
327515

328516
Security subassessment on a resource
@@ -338,8 +526,8 @@ Security subassessment on a resource
338526
| properties.id | string | Vulnerability ID |
339527
| properties.impact | string | Description of the impact of this subassessment |
340528
| properties.remediation | string | Information on how to remediate this subassessment |
341-
| properties.resourceDetails | ResourceDetails: [AzureResourceDetails](/rest/api/defenderforcloud/sub-assessments/list#azureresourcedetails) | Details of the resource that was assessed |
342-
| properties.status | [SubAssessmentStatus](/rest/api/defenderforcloud/sub-assessments/list#subassessmentstatus) | Status of the subassessment |
529+
| properties.resourceDetails | ResourceDetails: <br> [Azure Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---azure) <br> [AWS Resource Details](/azure/defender-for-cloud/subassessment-rest-api#resourcedetails---aws) | Details of the resource that was assessed |
530+
| properties.status | [SubAssessmentStatus](/azure/defender-for-cloud/subassessment-rest-api#subassessmentstatus) | Status of the subassessment |
343531
| properties.timeGenerated | string | The date and time the subassessment was generated |
344532
| type | string | Resource type |
345533

0 commit comments

Comments
 (0)