Azure / Azure/Microsoft-Defender-for-Cloud

No results found for a given Image Digest.

Open
#701 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
PowerShell
Stars
1.9k
Forks
871
Avg merge
3d 10h
Merged PRs (30d)
1

Description

**Describe the bug**

Running the script ImageScanSummaryAssessmentGate.ps1. Providing the input parameters for the script - registryName, Repository, Tag we find no results found for a given Image Digest sha256:f271e74b17ced29b915d351685fd4644785c6d1559dd1f2d4189a5e851ef753a

Screenshot of the Image and Digest below

![image](https://user-images.githubusercontent.com/12762259/215291422-e15dad01-bb7e-49f9-8e3b-90b95939e64b.png)

```
Microsoft-Defender-for-Cloud/Container Image Scan Vulnerability Assessment/Image Scan Automation Enrichment Security Gate> .\ImageScanSummaryAssessmentGate.ps1 -registryName myRegistry -repository library/alpine -tag 3.17.1
Extension 'resource-graph' is already installed.
Image Digest: sha256:f271e74b17ced29b915d351685fd4644785c6d1559dd1f2d4189a5e851ef753a
Query: securityresources
| where type == 'microsoft.security/assessments/subassessments'
| where id matches regex '(.+?)/providers/Microsoft.ContainerRegistry/registries/(.+)/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/'
| extend registryResourceId = tostring(split(id, '/providers/Microsoft.Security/assessments/')[0])
| extend registryResourceName = tostring(split(registryResourceId, '/providers/Microsoft.ContainerRegistry/registries/')[1])
| extend imageDigest = tostring(properties.additionalData.imageDigest)
| extend repository = tostring(properties.additionalData.repositoryName)
| extend patchable = tobool(properties.additionalData.patchable)
| extend scanFindingSeverity = tostring(properties.status.severity), scanStatus = tostring(properties.status.code)
| summarize findingsCountOverAll = count(), scanFindingSeverityCount = countif(patchable or not(tobool(False))) by scanFindingSeverity, scanStatus, registryResourceId, registryResourceName, repository, imageDigest
| summarize findingsCountOverAll = sum(findingsCountOverAll), severitySummary = make_bag(pack(scanFindingSeverity, scanFindingSeverityCount)) by registryResourceId, registryResourceName, repository, imageDigest, scanStatus
| summarize findingsCountOverAll = sum(findingsCountOverAll) , scanReport = make_bag_if(pack('scanStatus', scanStatus, 'scanSummary', severitySummary), scanStatus != 'NotApplicable')by registryResourceId, registryResourceName, repository, imageDigest
| extend IsScanned = iif(findingsCountOverAll > 0, true, false)
| where imageDigest =~ 'sha256:f271e74b17ced29b915d351685fd4644785c6d1559dd1f2d4189a5e851ef753a' and repository =~ 'library/alpine' and registryResourceName =~ 'myRegistry'

No results for image library/alpine:3.17.1 yet ...
No results for image library/alpine:3.17.1 yet ...
Write-Error: No results were found for digest: sha256:f271e74b17ced29b915d351685fd4644785c6d1559dd1f2d4189a5e851ef753a after 3 retries!
```

**To Reproduce**
Steps to reproduce the behavior:

1. Git Clone the Microsoft-Defender-for-Cloud repository to computer
2. Change to Container Image Scan Vulnerability Assessment folder/Image Scan Automation Enrichment Security Gate
3. '.\ImageScanSummaryAssessmentGate.ps1 -registryName myRegistry -repository library/alpine -tag 3.17.1'

**Expected behavior**
Entering the registryName, repository and tag should confirm the image has been scanned as per the defined script inputs.

Contributor guide

Open the contributing guide

Research direction

Start with Image Scan Automation Enrichment Security Gate/ImageScanSummaryAssessmentGate.ps1 and reproduce the command shown for library/alpine:3.17.1. Inspect the image digest lookup and the displayed Resource Graph query, then verify that the script reports scan results for the supplied digest instead of exhausting its retries.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.