https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/defender-%E5%A6%82%E4%BD%95%E6%89%A7%E8%A1%8C%E6%B3%A8%E5%86%8C%E8%A1%A8%E6%89%AB%E6%8F%8F/ta-p/527128 <DIV class="lia-message-template-content-zone"> <H2 id="toc-hId-1732525362"><FONT color="#FF6600">目标</FONT></H2> <P>在进行注册表扫描时，主机或Defender所在的集群的I/O操作中可能会出现嘀嗒声。</P> <H2 id="toc-hId--819631623"><FONT color="#FF6600">环境</FONT></H2> <UL data-aura-rendered-by="73724:0"> <LI>SaaS</LI> <LI>Self-Hosted 19.11 或更高版本</LI> </UL> <P>&nbsp;</P> <DIV class="lia-message-template-symptoms-zone"> <H2 id="toc-hId-1732525338"><FONT color="#FF6600"><SPAN>步骤</SPAN></FONT></H2> </DIV> <P>Defender在主机上下载图像并运行扫描，在完成扫描后，它将图像从主机上删除。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="1.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47043i8B6BAF66FCB5BEDF/image-size/large?v=v2&amp;px=999" role="button" title="1.png" alt="1.png" /></span></P> <P>&nbsp;</P> <P>这可以通过 ssh-ing 到具有Defender并用于执行注册表扫描的主机来确认。 Defender拉取镜像，如果我们执行“docker images”，我们可以在扫描运行时看到拉取的镜像</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47046i43D6020558D7C4AE/image-size/large?v=v2&amp;px=999" role="button" title="2.png" alt="2.png" /></span></P> <P>&nbsp;</P> <P>扫描完成后，我们再做一次 "docker images"，就会发现这个镜像不再存在了。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="3.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47047i156A8D249B2D57E1/image-size/large?v=v2&amp;px=999" role="button" title="3.png" alt="3.png" /></span></P> <P>&nbsp;</P> <P>因此，当注册表扫描正在运行时，我们看到I/O中出现了一个勾。</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> </DIV> Wed, 18 Jan 2023 07:12:00 GMT zji 2023-01-18T07:12:00Z https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/defender-%E5%A6%82%E4%BD%95%E6%89%A7%E8%A1%8C%E6%B3%A8%E5%86%8C%E8%A1%A8%E6%89%AB%E6%8F%8F/ta-p/527128 <DIV class="lia-message-template-content-zone"> <H2 id="toc-hId-1732525362"><FONT color="#FF6600">目标</FONT></H2> <P>在进行注册表扫描时，主机或Defender所在的集群的I/O操作中可能会出现嘀嗒声。</P> <H2 id="toc-hId--819631623"><FONT color="#FF6600">环境</FONT></H2> <UL data-aura-rendered-by="73724:0"> <LI>SaaS</LI> <LI>Self-Hosted 19.11 或更高版本</LI> </UL> <P>&nbsp;</P> <DIV class="lia-message-template-symptoms-zone"> <H2 id="toc-hId-1732525338"><FONT color="#FF6600"><SPAN>步骤</SPAN></FONT></H2> </DIV> <P>Defender在主机上下载图像并运行扫描，在完成扫描后，它将图像从主机上删除。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="1.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47043i8B6BAF66FCB5BEDF/image-size/large?v=v2&amp;px=999" role="button" title="1.png" alt="1.png" /></span></P> <P>&nbsp;</P> <P>这可以通过 ssh-ing 到具有Defender并用于执行注册表扫描的主机来确认。 Defender拉取镜像，如果我们执行“docker images”，我们可以在扫描运行时看到拉取的镜像</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47046i43D6020558D7C4AE/image-size/large?v=v2&amp;px=999" role="button" title="2.png" alt="2.png" /></span></P> <P>&nbsp;</P> <P>扫描完成后，我们再做一次 "docker images"，就会发现这个镜像不再存在了。</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="3.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/47047i156A8D249B2D57E1/image-size/large?v=v2&amp;px=999" role="button" title="3.png" alt="3.png" /></span></P> <P>&nbsp;</P> <P>因此，当注册表扫描正在运行时，我们看到I/O中出现了一个勾。</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> </DIV> Wed, 18 Jan 2023 07:12:00 GMT https://live.paloaltonetworks.com/t5/%E9%85%8D%E7%BD%AE%E5%92%8C%E5%AE%9E%E6%96%BD/defender-%E5%A6%82%E4%BD%95%E6%89%A7%E8%A1%8C%E6%B3%A8%E5%86%8C%E8%A1%A8%E6%89%AB%E6%8F%8F/ta-p/527128 zji 2023-01-18T07:12:00Z