Uh oh!
There was an error while loading. Please reload this page.
docs: Defender for Containers binary-drift suppression for interactive debugging - #102
Open
Matthew Chan (matt-chan) wants to merge 1 commit into
Open
Conversation
Microsoft Discovery's interactive container debugging (VS Code tunnel) downloads the VS Code CLI into the target container at runtime, which triggers expected Microsoft Defender for Containers "binary drift" alerts. Add customer guidance plus deployable IaC (ARM template, Bicep, and PowerShell/Bash scripts) that create two subscription-scoped alert-suppression rules, scoped by the debug process command line so unrelated workloads are unaffected. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
✅ Automated Check Results — All checks passedAll structural, schema, content, documentation, and secret scan checks passed. This PR is ready for human review. The maintainers have been automatically requested.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds customer guidance + deployable IaC for suppressing the expected Microsoft Defender for Containers "binary drift" alerts that occur when using Microsoft Discovery's interactive container debugging (VS Code tunnel).
To attach a debugger, Discovery downloads the VS Code CLI into the target container at runtime and runs it (plus the VS Code server it fetches on first connect). Binary drift detection flags any process started from a binary that wasn't in the container image, so these runtime-fetched binaries trigger the alert. It is expected and benign.
Contents (
docs/discovery-services/defender-drift-suppression/)README.md— what the alerts are, why they occur, and how to apply/verify/remove the rulesdefender-drift-suppression.json(ARM) and.bicep—az deployment sub createset-drift-suppression.sh/.ps1—az restscriptsTwo subscription-scoped alert-suppression rules, scoped by the debug process command line so unrelated workloads are unaffected:
Binary-drift-vscode-cli-downloadvscode-cli.tar.gzBinary-drift-vscode-cli-tunnel/tmp/_debug_cAll apply methods are idempotent.