{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "slug": "dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability", "url": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/" }, "title": "Check container image eligibility before interpreting a missing vulnerability assessment", "summary": "Which image-format limits should be checked when Defender for Containers has no assessment result?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:56+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Apply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.", "dse_recommendation": "DSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow.", "primary_source": { "name": "Containers support matrix in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. Microsoft Learn.

\n

Applicability

\n

Apply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.

\n

DSE recommendation

\n

DSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.

\n

Verification

\n

Select an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.

\n

Official references

\n

Microsoft Learn: Containers support matrix in Defender for Cloud. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. Microsoft Learn.\nApplicability\nApply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.\nDSE recommendation\nDSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.\nVerification\nSelect an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.\nOfficial references\nMicrosoft Learn: Containers support matrix in Defender for Cloud. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers).\n\n## Applicability\n\nApply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.\n\n## DSE recommendation\n\nDSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.\n\n## Verification\n\nSelect an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.\n\n## Official references\n\n[Microsoft Learn: Containers support matrix in Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "url": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check container image eligibility before interpreting a missing vulnerability assessment", "item": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "url": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/", "headline": "Check container image eligibility before interpreting a missing vulnerability assessment", "description": "Which image-format limits should be checked when Defender for Containers has no assessment result?", "abstract": "Which image-format limits should be checked when Defender for Containers has no assessment result?", "articleBody": "Source facts\nMicrosoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. Microsoft Learn.\nApplicability\nApply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.\nDSE recommendation\nDSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.\nVerification\nSelect an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.\nOfficial references\nMicrosoft Learn: Containers support matrix in Defender for Cloud. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:56+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check container image eligibility before interpreting a missing vulnerability assessment" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Containers support matrix in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers" } } ] } }