Azure / Azure/Microsoft-Defender-for-Cloud

ImageScanSummaryAssessmentGate.ps1 no longer finds assessments

Open
#858 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
1.9k
Forks
871
Avg merge
3d 10h
Merged PRs (30d)
1

Description

**Describe the bug**
The [container image scan vulnerability assessment script](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Container%20Image%20Scan%20Vulnerability%20Assessment) no longer seems to be working. I don't know if there was a schema change or API change on the Graph but it never finds results, even if they do actually appear in Defender for Cloud UI dashboard.

**To Reproduce**
Steps to reproduce the behavior:

1. Login to Azure CR via `az acr login -n ''
2. Navigate to the ps1 script
3. Execute the ps1 script:
```powershell
.\ImageScanSummaryAssessmentGate.ps1 -registryName "" -repository "" -tag 932
```
5. See error:
```
Image Digest: sha256:4a3e5843...snip...2063
Query: securityresources
| where type == 'microsoft.security/assessments/subassessments'
| where id matches regex '(.+?)/providers/Microsoft.ContainerRegistry/registries/(.+)/providers/Microsoft.Security/assessments/dbd0cb49-b563-45e7-9724-889e799fa648/'
| extend registryResourceId = tostring(split(id, '/providers/Microsoft.Security/assessments/')[0])
| extend registryResourceName = tostring(split(registryResourceId, '/providers/Microsoft.ContainerRegistry/registries/')[1])
| extend imageDigest = tostring(properties.additionalData.imageDigest)
| extend repository = tostring(properties.additionalData.repositoryName)
| extend patchable = tobool(properties.additionalData.patchable)
| extend scanFindingSeverity = tostring(properties.status.severity), scanStatus = tostring(properties.status.code)
| summarize findingsCountOverAll = count(), scanFindingSeverityCount = countif(patchable or not(tobool(False))) by scanFindingSeverity, scanStatus, registryResourceId, registryResourceName, repository, imageDigest
| summarize findingsCountOverAll = sum(findingsCountOverAll), severitySummary = make_bag(pack(scanFindingSeverity, scanFindingSeverityCount)) by registryResourceId, registryResourceName, repository, imageDigest, scanStatus
| summarize findingsCountOverAll = sum(findingsCountOverAll) , scanReport = make_bag_if(pack('scanStatus', scanStatus, 'scanSummary', severitySummary), scanStatus != 'NotApplicable')by registryResourceId, registryResourceName, repository, imageDigest
| extend IsScanned = iif(findingsCountOverAll > 0, true, false)
| where imageDigest =~ 'sha256:4a3e5843...snip...2063' and repository =~ '' and registryResourceName =~ ''

No results for image :932 yet ...
No results for image :932 yet ...
Write-Error: No results were found for digest: sha256:4a3e5843...snip...2063 after 3 retries!
```

**Expected behavior**
Historically, this script has executed locally just fine for me.

**Additional context**
This script is integrated into my AzDO pipeline and it halts pushes to Development environments if it does not pass. It's pretty slow already, requiring a 5 minute waiting period on the previous step, but now that it's not even finding results, it's even more frustrating.

Contributor guide

Open the contributing guide

Research direction

Start with Container Image Scan Vulnerability Assessment/ImageScanSummaryAssessmentGate.ps1 and reproduce the reported command against an image that appears in the Defender for Cloud UI. Inspect the securityresources query and its returned fields, then verify that the script finds the image digest and assessment results without exhausting its retries. Done means the pipeline no longer reports a false missing assessment.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.