Quarantine Preview and Qualys Interaction
- Dominant language
- No language data
- Stars
- 177
- Forks
- 137
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
The combination of the Quarantine preview feature and Qualys (Azure Defender CVE Scanning) do not work as expected.
**To Reproduce**
Steps to reproduce the behavior:
1. Enable quarantine on an ACR (see #210)
2. Enable Azure Defender for Container Registries to On (enables Qualys CVE scanning)
3. Push an image to the ACR
**Expected behavior**
When a container image is pushed to an ACR that has quarantine enabled, we expect the image will be scanned by qualys so we can programmatically determine whether to release the image for pulls. In other words, immediately after the image is pushed, even though it is quarantined we expect it to appear in the results of `az security sub-assessment list` however it does not.
Instead, the image is never scanned until it is released, defeating the purpose of the quarantine. It appears as though the feature was written entirely for DIY local or out-of-band image scanning, where the scanner has access to the source image and can support a pipeline that will remove the image from quarantine based on out-of-band scan results. This is great for users who want to integrate their own scanning with Azure Container Registry, however in this instance we are interested in leveraging Azure Container Registry, the Quarantine feature, and Azure Defender Qualys scanning.
To enable users who wish to quarantine images immediately on push pending the results of a Qualys scan (Azure Defender), the quarantine feature should support allowing the image to be scanned and appear on an `az security sub-assessment list` result query as either `Healthy` or `Unhealthy` regardless of whether the image is quarantined or not to enable programmatic quarantine removal of images based on Qualys results.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.