Azure / Azure/acr

Quarantine Preview and Qualys Interaction

Open
#499 16 comments 4 reactions 1 assignee Assigned to @toddysm View on GitHub
bug feature-vuln-management triaged
Dominant language
No language data
Stars
177
Forks
137
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
The combination of the Quarantine preview feature and Qualys (Azure Defender CVE Scanning) do not work as expected.

**To Reproduce**
Steps to reproduce the behavior:
1. Enable quarantine on an ACR (see #210)
2. Enable Azure Defender for Container Registries to On (enables Qualys CVE scanning)
3. Push an image to the ACR

**Expected behavior**
When a container image is pushed to an ACR that has quarantine enabled, we expect the image will be scanned by qualys so we can programmatically determine whether to release the image for pulls. In other words, immediately after the image is pushed, even though it is quarantined we expect it to appear in the results of `az security sub-assessment list` however it does not.

Instead, the image is never scanned until it is released, defeating the purpose of the quarantine. It appears as though the feature was written entirely for DIY local or out-of-band image scanning, where the scanner has access to the source image and can support a pipeline that will remove the image from quarantine based on out-of-band scan results. This is great for users who want to integrate their own scanning with Azure Container Registry, however in this instance we are interested in leveraging Azure Container Registry, the Quarantine feature, and Azure Defender Qualys scanning.

To enable users who wish to quarantine images immediately on push pending the results of a Qualys scan (Azure Defender), the quarantine feature should support allowing the image to be scanned and appear on an `az security sub-assessment list` result query as either `Healthy` or `Unhealthy` regardless of whether the image is quarantined or not to enable programmatic quarantine removal of images based on Qualys results.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.