Review & Remediate Security Risk Concerns via Cloud Security Explorer
Implementation Effort: Medium
This task involves enabling Defender for Containers, running graph-based queries in Cloud Security Explorer, and coordinating with security and platform teams to remediate identified risks.
User Impact: Low
Only security and infrastructure teams are involved in this process; end users are not affected.
Overview
The Cloud Security Explorer in Microsoft Defender for Containers allows security teams to proactively identify and remediate security risks using graph-based queries. It leverages the cloud security graph to surface contextual insights such as misconfigurations, vulnerabilities, and potential lateral movement paths between resources.
To review and remediate risks:
- Navigate to Microsoft Defender for Cloud > Cloud Security Explorer.
- Use built-in or custom queries to identify:
- Exposed pods or services
- Privileged containers
- Containers using host networking
- Vulnerable container images
- Misconfigured Kubernetes roles or bindings
- Review the attack paths and resource context to understand how risks are connected and prioritized 1 2 3.
- Apply remediations by:
- Updating Kubernetes configurations
- Rebuilding vulnerable images
- Applying Azure Policy or Gatekeeper constraints
- Restricting network exposure and access permissions This process supports the Zero Trust principle of "Assume Breach" by continuously analyzing the environment for exploitable paths and enabling proactive remediation to reduce the blast radius of potential attacks.
Risks if not implemented: Without using Cloud Security Explorer, critical attack paths and misconfigurations may go undetected, increasing the risk of lateral movement, privilege escalation, and data exposure.