How to get full list of affected digest for ACR vulnerability via REST API? about microsoft-defender-for-cloud HOT 19 CLOSED

Hello @zhongyi-zhang ,

SubAssessments API is yet to support resource filtering.
For a specific repository or image scan findings, I would recommend using Azure resource graph (ARG) resource query API.

You can use this guide as a reference for Image scan findings extraction using ARG query API.

from microsoft-defender-for-cloud.

Hi @wtomw, thanks for the points! Appreciate it! The guide is very helpful. I can get the data what I expect to get. The only problem is that, it can return at most 1000 rows. That's fine. I'd like to remediate the vulnerability one by one until all of them resolved...
One more question, what's the least permission to assign to a service principal so that it can call the ARG REST API? Hope it doesn't require permission as large as a subscription contributor...

from microsoft-defender-for-cloud.

Hi @zhongyi-zhang,
ARG REST API supports paging, so you can use that to extract the all records.

As for ARG REST API permissions requirements you can read more here, which should be correlated to Azure Security Center permissions requirements where you can read more on in here.

from microsoft-defender-for-cloud.

@wtomw thanks for the prompt reply!
Yeah, I find the $skipToken for paging in doc. But somehow in the response to my request, it doesn't return $skipToken, and returns "resultTruncated": "true". The result is indeed not complete since it shows "totalRecords": 8585, "count": 1000, in the response. Is there any required parameter to enable paging?

from microsoft-defender-for-cloud.

@zhongyi-zhang
ARG REST API query paging can be found in quey request options under here

from microsoft-defender-for-cloud.

@wtomw yes, I even tried adding the same option

"options": {
      "$top": 3,
      "$skip": 0
}

Then I got:

{
"totalRecords": 8585,
"count": 3,
"data": "<a-lot-of-rows>",
"facets": [],
"resultTruncated": "true"
}

No "$skipToken" returned.

This is my script:

DATA='{
  "subscriptions": [ <mySub> ],
  "query":"<myQuery>",
  "options": {
    "$top": 3,
    "$skip": 0
  }
}'
curl \
  -H "Content-Type:application/json" \
  -H "Authorization: Bearer ${accessToken}" \
  -d "${DATA}" \
  "https://management.azure.com/providers/Microsoft.ResourceGraph/resources?api-version=2019-04-01"

from microsoft-defender-for-cloud.

Looks like @wtomw - addressed the question from ASC perspective, now is more an ARG question and @wtomw provided the ARG documentation link.

from microsoft-defender-for-cloud.

@wtomw is there any update/ETA for a a reasonable REST API to obtain findings for a given image Id ?

I am looking for something that's similar to https://docs.aws.amazon.com/cli/latest/reference/ecr/describe-image-scan-findings.html

from microsoft-defender-for-cloud.

@gadinaor, the way to extract specific image findings is using Azure resource graph (ARG) resource query API.

You can use this guide as a reference for Image scan findings extraction using ARG query API.

Unfortunately, currently there is no support for filtering a specific image using the Sub Assessment REST API.

from microsoft-defender-for-cloud.

@wtomw so, I am down this rabbit 🐇 hole ... and the ARG query I have based on the guide you shared doesn't return the package name as a structured field (see info below) - am I missing anything? if not, what's the plan to add this field to the returned object?

My query:

securityresources
| where type == "microsoft.security/assessments"
//| where properties.displayName contains "Vulnerabilities in Azure Container Registry images should be remediated"
| summarize by assessmentKey=name //the ID of the assessment
| join kind=inner (
    securityresources
     | where type == "microsoft.security/assessments/subassessments"
     | extend assessmentKey = extract(".*assessments/(.+?)/.*",1,  id)
 ) on assessmentKey
| project assessmentKey, subassessmentKey=name, id, parse_json(properties), resourceGroup, subscriptionId, tenantId
| where properties.additionalData.imageDigest == "sha256:4343f035d365cc3968f4276e712dbb42908de6f5538611668b03b7b69c142593"
| extend description = properties.description,
         displayName = properties.displayName,
         resourceId = properties.resourceDetails.id,
         resourceSource = properties.resourceDetails.source,
         category = properties.category,
         severity = properties.status.severity,
         code = properties.status.code,
         timeGenerated = properties.timeGenerated,
         remediation = properties.remediation,
         impact = properties.impact,
         vulnId = properties.id,
         additionalData = properties.additionalData,
	repositoryName = properties.additionalData.repositoryName,
        imageDigest = properties.additionalData.imageDigest

here's the properties object returned from this query:

{
    "description": "Debian has released security update for systemd to fix the vulnerabilities.<P>",
    "displayName": "Debian Security Update for systemd",
    "resourceDetails": {
        "source": "Azure",
        "id": "/repositories/myrepo/manyvuln/images/sha256:4343f035d365cc3968f4276e712dbb42908de6f5538611668b03b7b69c142593"
    },
    "additionalData": {
        "assessedResourceType": "ContainerRegistryVulnerability",
        "vendorReferences": [
            {
                "title": "CVE-2018-1049",
                "link": "https://security-tracker.debian.org/tracker/CVE-2018-1049"
            },
            {
                "title": "CVE-2018-15686",
                "link": "https://security-tracker.debian.org/tracker/CVE-2018-15686"
            }
        ],
        "publishedTime": "2019-05-06T10:54:00.0000000Z",
        "patchable": true,
        "type": "Vulnerability",
        "cvss": {
            "2.0": {
                "base": 10
            },
            "3.0": {
                "base": 9.8
            }
        },
        "cve": [
            {
                "title": "CVE-2018-1049",
                "link": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1049"
            },
            {
                "title": "CVE-2018-15686",
                "link": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15686"
            }
        ],
        "repositoryName": "myrepo/manyvuln",
        "registryHost": "myregistry.azurecr.io",
        "imageDigest": "sha256:4343f035d365cc3968f4276e712dbb42908de6f5538611668b03b7b69c142593"
    },
    "status": {
        "severity": "High",
        "code": "Unhealthy"
    },
    "timeGenerated": "2020-10-17T07:35:03.4900000Z",
    "remediation": "Refer to <A HREF=\"https://security-tracker.debian.org/tracker/CVE-2018-15686\" TARGET=\"_blank\">Debian 9 - CVE-2018-15686</A> and <A HREF=\"https://security-tracker.debian.org/tracker/CVE-2018-1049\" TARGET=\"_blank\">Debian 9 - CVE-2018-1049</A> to address this issue and obtain further details.\n<P>Patch:<BR>\nFollowing are links for downloading patches to fix the vulnerabilities:\n<P> <A HREF=\"https://security-tracker.debian.org/tracker/CVE-2018-15686\" TARGET=\"_blank\">CVE-2018-15686: Debian</A><P> <A HREF=\"https://security-tracker.debian.org/tracker/https://security-tracker.debian.org/tracker/CVE-2018-15686\" TARGET=\"_blank\">CVE-2018-1049: Debian</A>",
    "category": "Debian",
    "id": "176875",
    "impact": "This vulnerability could be exploited to gain partial access to sensitive information. Malicious users could also use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability."
}

from microsoft-defender-for-cloud.

@gadinaor, what do you mean by package name? which property is missing?

from microsoft-defender-for-cloud.

@wtomw in the example above ... the findings are on systemd package - it’s noted in the description field , however there is no field in the properties that this information is available . Normally - the information includes the vulnerable package name and vulnerable package version

from microsoft-defender-for-cloud.

@gadinaor, Currently there is no property in the SubAssessment object that reflects the specific package the vulnerability is related to.

from microsoft-defender-for-cloud.

Knowing the specific package and version the vulnerability was found for in a container image is a crucial piece of information so that you can address the vulnerability. Are there any plans to add this information to the SubAssessment Object?

from microsoft-defender-for-cloud.

@sean-keane25, the package details are available in finding's description. Currently we don't have a dedicated property for package version.

from microsoft-defender-for-cloud.

@wtomw - is there an open issue for this ? or shall I create one?

from microsoft-defender-for-cloud.

@wtomw I do not see the package details in findings description. Even in the example @gadinaor posts above I do not see this information. Perhaps I am missing something ?

from microsoft-defender-for-cloud.

@sean-keane25, are you referring perhaps to specifying the layer of which the finds were found on? if so, this is in our plans, no ETA at the moment.

from microsoft-defender-for-cloud.

@gadinaor, you can add dedicated affected package property as a feature request.

from microsoft-defender-for-cloud.