Microsoft Defender for Cloud
Cloud and workloads

Review Security Findings in the AKS Security Dashboard - Microsoft Defender for Cloud | Microsoft Learn

In brief

The article now expands Defender CSPM and CVE on first use, clarifies the dashboard’s purpose, standardizes severity labels and Kubernetes terminology, and improves wording and punctuation.

What Defender admins need to know

Administrators can interpret the dashboard guidance and prerequisites more easily; no configuration change is stated.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

Review security findingsSecurity Findings in the AKS security dashboardSecurity Dashboard - Microsoft Defender for Cloud | Microsoft Learn

The AKS security dashboard shows security findings for an Azure Kubernetes Service (AKS) cluster in Microsoft Defender for Cloud.

This article explains how to You can review, investigate, and remediate security alerts, vulnerabilities, misconfigurations, and compliance findings in the dashboard.

Prerequisites

To use the AKS Securitysecurity dashboard, ensure you have:

Review security findings

Alerts are prioritized by severity to help you identify which issues to investigate first:

  • High: High probability that the resource is compromised. Investigate immediately.
  • Medium: Indicates suspicious activity that might represent a compromise.
  • Low: Might indicate a benign or blocked activity.
  • Informational: Provides context and might be relevant when correlated with other alerts.

Investigate a security alert

Findings are prioritized by severity. When Defender CSPM is enabled, prioritization also considers contextual risk signals.

Each finding includes affected packages, associated CVEs,common vulnerabilities and exposures (CVEs), and the fixed version to remediate the issue.

Vulnerabilities can include:

  • Review affected packages and associated CVEs.
  • Identify the fixed version for the vulnerable package.
  • Update the container image or dependency to remediatefix the issue.

If expected vulnerabilities don't appear, verify that the image, package type, and environment are supported. See the support matrix for Defender for Containers.

Findings are based on Azure Policy and Kubernetes configuration assessments.

Review these findings with network exposure in mind, including Kubernetes Serviceservice types and ingress configurations that can unintentionally expose workloads to the internet.

Each finding includes remediation guidance. Some findings support automated remediation through Quick Fix or policy enforcement.

In the details pane:

  • Review the description and remediation steps.
  • Review Kubernetes Serviceservice types and ingress exposure settings to reduce unintended internet-facing access.
  • For cluster-level misconfigurations, select Quick Fix when available.
  • For workload issues, apply the recommended Azure Policy to prevent recurrence.
  • Assign an owner to track remediation (requires Defender CSPM).

Compliance

The compliance section shows the cluster’cluster's status against regulatory standards and benchmarks.

It lists controls that the cluster doesn't meet and provides recommendations to help you remediate them.