Get started with Agentless Vulnerability & Threat Detection in AWS

To start scanning for vulnerabilities and malware in your cloud resources, add your AWS account to Trend Vision One in Cloud Accounts using the CloudFormation template. Enable Agentless Vulnerability & Threat Detection, and then click Scanner Settings to choose the resource types to scan and whether to scan for vulnerabilities, malware, or both. Vulnerability scanning is enabled for all supported resources by default. Anti-malware scanning is disabled by default. You can change the scanning configuration at any time. For detailed instructions, see Adding an AWS account using CloudFormation.

Agentless Vulnerability & Threat Detection scans the following AWS resource types:

Agentless Vulnerability & Threat Detection works in AWS by taking a snapshot of EBS volumes and collecting ECR images, Lambda function zip archives, and Lambda layers. The collected resources are then scanned for vulnerabilities or malware. Lambda functions deployed with container images are covered by ECR image scanning.

Scan results are sent to Trend Vision One and can be seen in Cloud Posture, Executive Dashboard, Operations Dashboard, and asset profile screens in Attack Surface Discovery. After you patch vulnerabilities or remediate malware in EBS volumes, Lambda functions, or Lambda layers, the detections no longer appear after the next daily scan. Vulnerability detections in ECR images remain visible in Operations Dashboard → Vulnerabilities for seven days after patching. Malware detections in ECR images remain visible in Operations Dashboard → All Risk Events for seven days after remediation.

The following table lists scanning limitations that apply to each supported AWS resource type. For estimated costs of deploying Agentless Vulnerability & Threat Detection in your AWS accounts, see Agentless Vulnerability & Threat Detection estimated deployment costs for AWS

Agentless Vulnerability & Threat Detection supports the following operating system instances for AWS accounts.

Agentless Vulnerability & Threat Detection supports the following AWS regions.