MDC_K8sRuningImagesVulnerabilityAssessmentBasedOnMDVM_Audit.json

{
  "properties": {
    "displayName": "Azure running container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Container image vulnerability assessment scans your registry for commonly known vulnerabilities (CVEs) and provides a detailed vulnerability report for each image. This recommendation provides visibility to vulnerable images currently running in your Kubernetes clusters. Remediating vulnerabilities in container images that are currently running is key to improving your security posture, significantly reducing the attack surface for your containerized workloads.",
    "metadata": {
      "version": "1.0.1",
      "category": "Security Center"
    },
    "version": "1.0.1",
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.ContainerService/managedClusters"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/assessments",
          "name": "c609cf0f-71ab-41e9-a3c6-9a1f7fe1b8d5",
          "existenceCondition": {
            "field": "Microsoft.Security/assessments/status.code",
            "in": [
              "NotApplicable",
              "Healthy"
            ]
          }
        }
      }
    },
    "versions": [
      "1.0.1",
      "1.0.0"
    ]
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/17f4b1cc-c55c-4d94-b1f9-2978f6ac2957",
  "name": "17f4b1cc-c55c-4d94-b1f9-2978f6ac2957"
}