Skip to content

Commit f071ab2

Browse files
bmansheimbmansheim
committed
Move July RNs to archive
1 parent c76c786 commit f071ab2

File tree

2 files changed

+82
-82
lines changed

2 files changed

+82
-82
lines changed

‎articles/defender-for-cloud/release-notes-archive.md

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,88 @@ This page provides you with information about:
1717
- Bug fixes
1818
- Deprecated functionality
1919

20+
## July 2022
21+
22+
Updates in July include:
23+
24+
- [General availability (GA) of the Cloud-native security agent for Kubernetes runtime protection](#general-availability-ga-of-the-cloud-native-security-agent-for-kubernetes-runtime-protection)
25+
- [Defender for Container's VA adds support for the detection of language specific packages (Preview)](#defender-for-containers-va-adds-support-for-the-detection-of-language-specific-packages-preview)
26+
- [Protect against the Operations Management Infrastructure vulnerability CVE-2022-29149](#protect-against-the-operations-management-infrastructure-vulnerability-cve-2022-29149)
27+
- [Integration with Entra Permissions Management](#integration-with-entra-permissions-management)
28+
- [Key Vault recommendations changed to "audit"](#key-vault-recommendations-changed-to-audit)
29+
- [Deprecate API App policies for App Service](#deprecate-api-app-policies-for-app-service)
30+
31+
### General availability (GA) of the cloud-native security agent for Kubernetes runtime protection
32+
33+
We're excited to share that the cloud-native security agent for Kubernetes runtime protection is now generally available (GA)!
34+
35+
The production deployments of Kubernetes clusters continue to grow as customers continue to containerize their applications. To assist with this growth, the Defender for Containers team has developed a cloud-native Kubernetes oriented security agent.
36+
37+
The new security agent is a Kubernetes DaemonSet, based on eBPF technology and is fully integrated into AKS clusters as part of the AKS Security Profile.
38+
39+
The security agent enablement is available through auto-provisioning, recommendations flow, AKS RP or at scale using Azure Policy.
40+
41+
You can [deploy the Defender profile](./defender-for-containers-enable.md?pivots=defender-for-container-aks&tabs=aks-deploy-portal%2ck8s-deploy-asc%2ck8s-verify-asc%2ck8s-remove-arc%2caks-removeprofile-api#deploy-the-defender-profile) today on your AKS clusters.
42+
43+
With this announcement, the runtime protection - threat detection (workload) is now also generally available.
44+
45+
Learn more about the Defender for Container's [feature availability](supported-machines-endpoint-solutions-clouds-containers.md).
46+
47+
You can also review [all available alerts](alerts-reference.md#alerts-k8scluster).
48+
49+
Note, if you're using the preview version, the `AKS-AzureDefender` feature flag is no longer required.
50+
51+
### Defender for Container's VA adds support for the detection of language specific packages (Preview)
52+
53+
Defender for Container's vulnerability assessment (VA) is able to detect vulnerabilities in OS packages deployed via the OS package manager. We have now extended VA's abilities to detect vulnerabilities included in language specific packages.
54+
55+
This feature is in preview and is only available for Linux images.
56+
57+
To see all of the included language specific packages that have been added, check out Defender for Container's full list of [features and their availability](supported-machines-endpoint-solutions-clouds-containers.md#registries-and-images).
58+
59+
### Protect against the Operations Management Infrastructure vulnerability CVE-2022-29149
60+
61+
Operations Management Infrastructure (OMI) is a collection of cloud-based services for managing on-premises and cloud environments from one single place. Rather than deploying and managing on-premises resources, OMI components are entirely hosted in Azure.
62+
63+
Log Analytics integrated with Azure HDInsight running OMI version 13 requires a patch to remediate [CVE-2022-29149](https://nvd.nist.gov/vuln/detail/CVE-2022-29149). Review the report about this vulnerability in the [Microsoft Security Update guide](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-29149) for information about how to identify resources that are affected by this vulnerability and remediation steps.
64+
65+
If you have Defender for Servers enabled with Vulnerability Assessment, you can use [this workbook](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workbooks/OMI%20Vulnerability%20Dashboard) to identify affected resources.
66+
67+
### Integration with Entra Permissions Management
68+
69+
Defender for Cloud has integrated with [Microsoft Entra Permissions Management](../active-directory/cloud-infrastructure-entitlement-management/index.yml), a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility and control over permissions for any identity and any resource in Azure, AWS, and GCP.
70+
71+
Each Azure subscription, AWS account, and GCP project that you onboard, will now show you a view of your [Permission Creep Index (PCI)](../active-directory/cloud-infrastructure-entitlement-management/ui-dashboard.md).
72+
73+
Learn more about [Entra Permission Management (formerly Cloudknox)](other-threat-protections.md#entra-permission-management-formerly-cloudknox)
74+
75+
### Key Vault recommendations changed to "audit"
76+
77+
The effect for the Key Vault recommendations listed here was changed to "audit":
78+
79+
| Recommendation name | Recommendation ID |
80+
| ------- | ------ |
81+
| Validity period of certificates stored in Azure Key Vault should not exceed 12 months | fc84abc0-eee6-4758-8372-a7681965ca44 |
82+
| Key Vault secrets should have an expiration date | 14257785-9437-97fa-11ae-898cfb24302b |
83+
| Key Vault keys should have an expiration date | 1aabfa0d-7585-f9f5-1d92-ecb40291d9f2 |
84+
85+
86+
### Deprecate API App policies for App Service
87+
88+
We deprecated the following policies to corresponding policies that already exist to include API apps:
89+
90+
| To be deprecated | Changing to |
91+
|--|--|
92+
|`Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'` | `App Service apps should have 'Client Certificates (Incoming client certificates)' enabled` |
93+
| `Ensure that 'Python version' is the latest, if used as a part of the API app` | `App Service apps that use Python should use the latest Python version'` |
94+
| `CORS should not allow every resource to access your API App` | `App Service apps should not have CORS configured to allow every resource to access your apps` |
95+
| `Managed identity should be used in your API App` | `App Service apps should use managed identity` |
96+
| `Remote debugging should be turned off for API Apps` | `App Service apps should have remote debugging turned off` |
97+
| `Ensure that 'PHP version' is the latest, if used as a part of the API app` | `App Service apps that use PHP should use the latest 'PHP version'`|
98+
| `FTPS only should be required in your API App` | `App Service apps should require FTPS only` |
99+
| `Ensure that 'Java version' is the latest, if used as a part of the API app` | `App Service apps that use Java should use the latest 'Java version'` |
100+
| `Latest TLS version should be used in your API App` | `App Service apps should use the latest TLS version` |
101+
20102
## June 2022
21103

22104
Updates in June include:

‎articles/defender-for-cloud/release-notes.md

Lines changed: 0 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -366,85 +366,3 @@ Defender for Container's vulnerability assessment (VA) now includes detailed pac
366366
This detailed package information is available for new scans of images.
367367

368368
:::image type="content" source="media/release-notes/mdc-container-va-package-information.png" alt-text="Screenshot of the package information for container vulnerabilities." lightbox="media/release-notes/mdc-container-va-package-information.png":::
369-
370-
## July 2022
371-
372-
Updates in July include:
373-
374-
- [General availability (GA) of the Cloud-native security agent for Kubernetes runtime protection](#general-availability-ga-of-the-cloud-native-security-agent-for-kubernetes-runtime-protection)
375-
- [Defender for Container's VA adds support for the detection of language specific packages (Preview)](#defender-for-containers-va-adds-support-for-the-detection-of-language-specific-packages-preview)
376-
- [Protect against the Operations Management Infrastructure vulnerability CVE-2022-29149](#protect-against-the-operations-management-infrastructure-vulnerability-cve-2022-29149)
377-
- [Integration with Entra Permissions Management](#integration-with-entra-permissions-management)
378-
- [Key Vault recommendations changed to "audit"](#key-vault-recommendations-changed-to-audit)
379-
- [Deprecate API App policies for App Service](#deprecate-api-app-policies-for-app-service)
380-
381-
### General availability (GA) of the cloud-native security agent for Kubernetes runtime protection
382-
383-
We're excited to share that the cloud-native security agent for Kubernetes runtime protection is now generally available (GA)!
384-
385-
The production deployments of Kubernetes clusters continue to grow as customers continue to containerize their applications. To assist with this growth, the Defender for Containers team has developed a cloud-native Kubernetes oriented security agent.
386-
387-
The new security agent is a Kubernetes DaemonSet, based on eBPF technology and is fully integrated into AKS clusters as part of the AKS Security Profile.
388-
389-
The security agent enablement is available through auto-provisioning, recommendations flow, AKS RP or at scale using Azure Policy.
390-
391-
You can [deploy the Defender profile](./defender-for-containers-enable.md?pivots=defender-for-container-aks&tabs=aks-deploy-portal%2ck8s-deploy-asc%2ck8s-verify-asc%2ck8s-remove-arc%2caks-removeprofile-api#deploy-the-defender-profile) today on your AKS clusters.
392-
393-
With this announcement, the runtime protection - threat detection (workload) is now also generally available.
394-
395-
Learn more about the Defender for Container's [feature availability](supported-machines-endpoint-solutions-clouds-containers.md).
396-
397-
You can also review [all available alerts](alerts-reference.md#alerts-k8scluster).
398-
399-
Note, if you're using the preview version, the `AKS-AzureDefender` feature flag is no longer required.
400-
401-
### Defender for Container's VA adds support for the detection of language specific packages (Preview)
402-
403-
Defender for Container's vulnerability assessment (VA) is able to detect vulnerabilities in OS packages deployed via the OS package manager. We have now extended VA's abilities to detect vulnerabilities included in language specific packages.
404-
405-
This feature is in preview and is only available for Linux images.
406-
407-
To see all of the included language specific packages that have been added, check out Defender for Container's full list of [features and their availability](supported-machines-endpoint-solutions-clouds-containers.md#registries-and-images).
408-
409-
### Protect against the Operations Management Infrastructure vulnerability CVE-2022-29149
410-
411-
Operations Management Infrastructure (OMI) is a collection of cloud-based services for managing on-premises and cloud environments from one single place. Rather than deploying and managing on-premises resources, OMI components are entirely hosted in Azure.
412-
413-
Log Analytics integrated with Azure HDInsight running OMI version 13 requires a patch to remediate [CVE-2022-29149](https://nvd.nist.gov/vuln/detail/CVE-2022-29149). Review the report about this vulnerability in the [Microsoft Security Update guide](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-29149) for information about how to identify resources that are affected by this vulnerability and remediation steps.
414-
415-
If you have Defender for Servers enabled with Vulnerability Assessment, you can use [this workbook](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workbooks/OMI%20Vulnerability%20Dashboard) to identify affected resources.
416-
417-
### Integration with Entra Permissions Management
418-
419-
Defender for Cloud has integrated with [Microsoft Entra Permissions Management](../active-directory/cloud-infrastructure-entitlement-management/index.yml), a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility and control over permissions for any identity and any resource in Azure, AWS, and GCP.
420-
421-
Each Azure subscription, AWS account, and GCP project that you onboard, will now show you a view of your [Permission Creep Index (PCI)](../active-directory/cloud-infrastructure-entitlement-management/ui-dashboard.md).
422-
423-
Learn more about [Entra Permission Management (formerly Cloudknox)](other-threat-protections.md#entra-permission-management-formerly-cloudknox)
424-
425-
### Key Vault recommendations changed to "audit"
426-
427-
The effect for the Key Vault recommendations listed here was changed to "audit":
428-
429-
| Recommendation name | Recommendation ID |
430-
| ------- | ------ |
431-
| Validity period of certificates stored in Azure Key Vault should not exceed 12 months | fc84abc0-eee6-4758-8372-a7681965ca44 |
432-
| Key Vault secrets should have an expiration date | 14257785-9437-97fa-11ae-898cfb24302b |
433-
| Key Vault keys should have an expiration date | 1aabfa0d-7585-f9f5-1d92-ecb40291d9f2 |
434-
435-
436-
### Deprecate API App policies for App Service
437-
438-
We deprecated the following policies to corresponding policies that already exist to include API apps:
439-
440-
| To be deprecated | Changing to |
441-
|--|--|
442-
|`Ensure API app has 'Client Certificates (Incoming client certificates)' set to 'On'` | `App Service apps should have 'Client Certificates (Incoming client certificates)' enabled` |
443-
| `Ensure that 'Python version' is the latest, if used as a part of the API app` | `App Service apps that use Python should use the latest Python version'` |
444-
| `CORS should not allow every resource to access your API App` | `App Service apps should not have CORS configured to allow every resource to access your apps` |
445-
| `Managed identity should be used in your API App` | `App Service apps should use managed identity` |
446-
| `Remote debugging should be turned off for API Apps` | `App Service apps should have remote debugging turned off` |
447-
| `Ensure that 'PHP version' is the latest, if used as a part of the API app` | `App Service apps that use PHP should use the latest 'PHP version'`|
448-
| `FTPS only should be required in your API App` | `App Service apps should require FTPS only` |
449-
| `Ensure that 'Java version' is the latest, if used as a part of the API app` | `App Service apps that use Java should use the latest 'Java version'` |
450-
| `Latest TLS version should be used in your API App` | `App Service apps should use the latest TLS version` |

0 commit comments

Comments
 (0)