Microsoft Defender Recommendations for vulnerability findings are not getting refreshed

Mijo Joseph 6

I have integrated the vulnerability assessment solution by Qualys using the ARM template in 2 of my VMs.
I used the below template

{  
 "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",  
 "contentVersion": "1.0.0.0",  
 "parameters": {  
 "virtualMachineName": {  
 "defaultValue": null,  
 "metadata": {  
 "description": "Name of virtual machine to create."  
 },  
 "type": "string"  
 }  
 },  
 "resources": [  
 {  
 "apiVersion": "2015-06-01-preview",  
 "name": "[concat(parameters('virtualMachineName'), '/Microsoft.Security/default')]",  
 "type": "Microsoft.Compute/virtualMachines/providers/serverVulnerabilityAssessments"  
 }  
 ]  
}

But it is not refreshing the recommendations properly. Please see the image.

one of the VM is listing as unhealthy resource and another one is listing as not applicable resource.

I installed the updates and did the necessary remediation steps, kept the VM running for more than
days but it is not refreshing the recommendation for unhealthy resource. And for the not applicable resource it is saying "Findings have not been received yet for the VM".

Can some one help me on this?

JamesTran-MSFT 36,541 Reputation points Microsoft Employee

2022-10-18T22:49:13.623+00:00
@Mijo Joseph
Thank you for your post!

I understand that you've integrated the vulnerability assessment solution by Qualys using the ARM template above in two of your VMs. However, after a few days you're still seeing the VMs reporting as unhealthy for one and not applicable for the other.

When it comes to troubleshooting this issue, can you check that the Qualys extension is properly installed?

You can use the curl command to check the connectivity to the relevant Qualys URL. In addition, make sure that the DNS resolution for these URLs is successful and that everything is valid with the certificate authority that is used.

For your one VM showing as not applicable, it could be that Defender for Cloud can't deploy the vulnerability scanner extension on the VM for multiple reasons. For more info.

Can you share a screenshot of the vulnerability scanner extension status from your VM?

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,541 Reputation points Microsoft Employee

2022-10-20T02:20:31.783+00:00

@Mijo Joseph
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Mijo Joseph 6 Reputation points

2022-10-20T18:19:33.803+00:00

This is the screen shot for unhealthy VM
Mijo Joseph 6 Reputation points

2022-10-20T18:22:57.203+00:00

I tried the curl command and it is giving the response as {"code":404,"message":"HTTP 404 Not Found"}
Mijo Joseph 6 Reputation points

2022-10-20T18:24:23.083+00:00

In order to install the qualys extension, I just need to run the above arm template right? Am I missing any steps here?

Share via

Microsoft Defender Recommendations for vulnerability findings are not getting refreshed