How Azure TRE deployments are handling Microsoft Defender for Cloud recommendations?

[Ansar Rafique (ansarrafique)]

We have recently enabled Microsoft Defender for Cloud to monitor the security of our Azure TRE deployment.

Defender is reporting a large number of security recommendations across different Azure TRE resources, including a number of high-severity vulnerability findings. Many of these relate to software packages and dependencies used by the deployed services.

We are interested in understanding how other Azure TRE users are approaching these findings.

More specifically:

1. Do you see similar recommendations in your Azure TRE deployments?
2. How do you normally review and prioritise Defender recommendations for Azure TRE?
3. For vulnerabilities coming from standard Azure TRE components, should these normally be fixed upstream, or are individual deployments expected to address them?
4. If you make fixes locally, how do you manage them while keeping your deployment close to upstream Azure TRE?

It would be useful to hear how other Azure TRE users are approaching this and whether there is a recommended way of managing Defender for Cloud findings.

[Jack Morris (rudolphjacksonm)]

Hi Ansar,

We're about to release version 0.29.0 which may address a portion of these findings. This is a fairly large release with an upgrade from Pydantic v1-->v2, which blocked quite a few dependency upgrades until that was resolved. I'd be curious to see how many of these findings resolve once your TRE is updated to this version. It's in pre-release now if you want to take a look at it ahead of it being marked as latest.

For vulnerabilities coming from standard Azure TRE components, should these normally be fixed upstream, or are individual deployments expected to address them?

On this point, I would set the expectation that these should be fixed upstream by this project, as addressing them in your individual deployments could involve drift that makes upgrades incompatible in the future. If there is a specific vulnerability that is causing concern, please by all means raise a pull request to upgrade that component and any code changes that may be required. Or, alternatively raise an issue and we'll get it assigned. We're working to get releases out on a more frequent cadence which should also help keep the number of vulnerabilities lower.