edited kuberneted nodes alertd page sarabeth

Author: snicklezzz

articles/defender-for-cloud/kubernetes-nodes-malware.md

@@ -1,38 +1,45 @@
 ---
-title: Kubernetes Nodes Malware Detection
-description: Learn about Defender for Containers malware detection for Kubernetes nodes.
-ms.date: 03/02/2026
-ms.topic: concept-article
+title: Review and remediate malware alerts for Kubernetes nodes
+description: Learn how to review and remediate malware alerts for Kubernetes nodes in Defender for Containers.
+ms.date: 04/09/2026
+ms.topic: how-to
 ms.custom: sfi-image-nochange
 ---
 
-# Kubernetes node malware detection
-
-Defender for Containers uses the Microsoft Defender Antivirus anti-malware engine to scan and detect malicious files in Kubernetes nodes. When threats are detected, security alerts are directed into Defender for Cloud and Defender XDR, where they can be investigated and remediated.
+# Review and remediate malware alerts for Kubernetes nodes
 
+Defender for Containers uses the Microsoft Defender Antivirus anti-malware engine to scan Kubernetes nodes for malicious files. When malware is detected, Defender for Cloud generates security alerts that can be investigated and remediated in Defender for Cloud and Defender XDR.
 
 ## Prerequisites
-Malware detection in Kubernetes nodes must be [enabled by turning on the **Agentless scanning for machines**](./kubernetes-nodes-overview.md#enable-agentless-scanning-for-machines) option in the Defender for Containers or Defender for Servers P2 plan.
 
-> [!NOTE]
-> Malware detection is **not** performed on Kubernetes nodes if agentless scanning for machines is enabled through the Defender Cloud Security Posture Management Plan. Agentless scanning for machines must be enabled through Defender for Containers or Defender for Servers P2 plan.
+Before you begin, make sure that:
+
+- You have an Azure subscription. If you don’t have an Azure subscription, create a [free account](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn) before you begin.
 
-## Review and remediate the Kubernetes node malware security alerts
+- [Microsoft Defender for Cloud is enabled on your subscription](connect-azure-subscription.md) with one of the following plans:
+    - Defender for Containers
+    - Defender for Servers P2
 
-If malware is found in Kubernetes nodes, a malware security alert is generated for the customer to review. To review a Kubernetes node malware security alert in the Azure portal:
+- [Agentless scanning for machines](kubernetes-nodes-overview.md#enable-agentless-scanning-for-machines) is enabled.
+
+## Review and remediate Kubernetes node malware alerts
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Go to **Microsoft Defender for Cloud** > **General** > **Security alerts**.
+1. Go to **Microsoft Defender for Cloud** > **Security alerts**.
+
+1. Select the relevant malware alert for the Kubernetes node.
 
-1. Select the relevant malware security alert for the Kubernetes node.
     :::image type="content" source="media/kubernetes-nodes-malware/security-alerts-list-select.png" alt-text="Screenshot of selecting the line showing the malware security alert for the Kubernetes node." lightbox="media/kubernetes-nodes-malware/security-alerts-list-select.png":::
 
-1. Select the **View full details** button.  
+1. Select **View full details** to review the detected malware, including affected node pools and malware files.
+
     :::image type="content" source="media/kubernetes-nodes-malware/security-alert-detail.png" alt-text="Screenshot of selecting the view full details button to view the full details." lightbox="media/kubernetes-nodes-malware/security-alert-detail.png":::
 
-1. The security alert details describe the malware found, including the affected node pools and malware files found. Select the **Next: Take Action** button to view the instructions to remediate the threat.
+1. Select **Next: Take Action >>** to open the remediation guidance.
+
     :::image type="content" source="media/kubernetes-nodes-malware/security-alert-detail-full.png" alt-text="Screenshot of selecting the take action tab to see the instructions to remediate the threat." lightbox="media/kubernetes-nodes-malware/security-alert-detail-full.png":::
 
-1. Follow the instructions to remediate the threat.
-    :::image type="content" source="media/kubernetes-nodes-malware/security-alert-detail-take-action.png" alt-text="Screenshot showing the instructions to remediate the threat." lightbox="media/kubernetes-nodes-malware/security-alert-detail-take-action.png":::
+1. Follow the recommended steps to remediate the threat.
+
+    :::image type="content" source="media/kubernetes-nodes-malware/security-alert-detail-take-action.png" alt-text="Screenshot showing the instructions to remediate the threat." lightbox="media/kubernetes-nodes-malware/security-alert-detail-take-action.png":::