rules/findings/azure/defender/azure-defender-agentless-scanning-for-machines-disabled.json
|
{
"provider": "Azure", "serviceType": "Defender for Cloud", "serviceName": "Subscription", "displayName": "Ensure that \u0027Agentless scanning for machines\u0027 component status is set to \u0027On\u0027", "description": "Using disk snapshots, the agentless scanner scans for installed software, vulnerabilities, and plain text secrets.", "rationale": "The Microsoft Defender for Cloud agentless machine scanner provides threat detection, vulnerability detection, and discovery of sensitive information.", "impact": "\r\n\t\tAgentless scanning for machines requires licensing and is included in these plans: \r\n\t\t* Defender CSPM \r\n\t\t* Defender for Servers plan 2\r\n ", "remediation": { "text": null, "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-agentless-data-collection", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response#ir-2-preparation---setup-incident-notification", "https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.1.3.4", "profile": [ "Level 2" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "", "subPath": null, "selectCondition": { }, "query": [ ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": null, "showModalButton": null, "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ ], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "az_agentless_scanning_for_machines_disabled", "notes": [ ], "categories": [ ], "immutable_properties": [ ], "id": "azure_defender_004" } |