rules/findings/azure/defender/azure-defender-vulnerability-assessment-for-machines-disabled-plan.json
|
{
"provider": "Azure", "serviceType": "Defender for Cloud", "serviceName": "Subscription", "displayName": "Ensure that \u0027Vulnerability assessment for machines\u0027 component status is set to \u0027On\u0027", "description": "Enable vulnerability assessment for machines on both Azure and hybrid (Arc enabled) machines.", "rationale": "Vulnerability assessment for machines scans for various security-related configurations and events such as system updates, OS vulnerabilities, and endpoint protection, then produces alerts on threat and vulnerability findings.", "impact": "Microsoft Defender for Servers plan 2 licensing is required, and configuration of Azure Arc introduces complexity beyond this recommendation.", "remediation": { "text": "###### From Azure Portal\r\n\t\t\t\t1. From Azure Home select the Portal Menu \r\n\t\t\t\t2. Select Microsoft Defender for Cloud \r\n\t\t\t\t3. Under Management, select Environment Settings \r\n\t\t\t\t4. Select a subscription \r\n\t\t\t\t5. Click on Settings \u0026 Monitoring \r\n\t\t\t\t6. Set the Status of Vulnerability assessment for machines to On \r\n\t\t\t\t7. Click Continue\r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/defender-for-cloud/monitoring-components", "https://learn.microsoft.com/en-us/rest/api/defenderforcloud/auto-provisioning-settings/list?view=rest-defenderforcloud-2017-08-01-preview\u0026tabs=HTTP", "https://learn.microsoft.com/en-us/rest/api/defenderforcloud/auto-provisioning-settings/create?view=rest-defenderforcloud-2017-08-01-preview\u0026tabs=HTTP", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-posture-vulnerability-management#pv-5-perform-vulnerability-assessments" ], "compliance": [ { "name": "CIS Microsoft Azure Foundations", "version": "5.0.0", "reference": "8.1.3.2", "profile": [ "Level 2" ] } ], "level": "low", "tags": [], "rule": { "path": "az_defender", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "serverVulnerabilityAssessments.properties.selectedProvider", "eq", "MdeTvm" ] ] } ] } ], "shouldExist": "true", "returnObject": { "name": "azureServersSetting", "kind": "AzureServersSetting", "selectedProvider": "MdeTvm", "status": "Missing" }, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": {}, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [], "expandObject": null, "limit": null }, "showGoToButton": null, "showModalButton": null, "directLink": null } }, "text": { "data": { "properties": {}, "expandObject": null }, "status": { "keyName": [], "message": "", "defaultMessage": null }, "properties": { "resourceName": null, "resourceId": null, "resourceType": null }, "onlyStatus": false } }, "idSuffix": "azure_vulnerability_assessment_for_server_disabled", "notes": [], "categories": [], "immutableProperties": [], "id": "azure_defender_002" } |