Azure Policy for checking if VM is covered by a vulnerability assessment solution

Question

Hello,

I'm checking for ways to monitor if a VM is running a vulnerability assessment solution.

There exists a built-in policy with a title "A vulnerability assessment solution should be enabled on your virtual machines"

• https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F501541f7-f7e7-4cd6-868c-4190fdad3ac9
• https://www.azadvertizer.net/azpolicyadvertizer/501541f7-f7e7-4cd6-868c-4190fdad3ac9.html

This policy is checking if there is an assessment related to a VM of type "Microsoft.Security/assessments" and has a name of "ffff0522-1e88-47fc-8382-2a80ba848f5d".

However, I cannot find any documentation for "ffff0522-1e88-47fc-8382-2a80ba848f5d", except that it is a key related somehow to vulnerability management.

Would be grateful for any pointers!

Answer 1

Hello there,

To assess your machines for vulnerabilities, you can use one of the following solutions:

Microsoft Defender Vulnerability Management solution (included with Microsoft Defender for Servers)

Built-in Qualys agent (included with Microsoft Defender for Servers)

A Qualys or Rapid7 scanner that you've licensed separately and configured within Defender for Cloud (this scenario is called the Bring Your Own License, or BYOL, scenario)

https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

Answer 2

Some good pointers were already provided.

Microsoft.Security/assessments resources are automatically updated by Azure background processes.

To enable vulnerability assessment you can turn it on on subscription level: https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-vulnerability-assessment

• If you select Defender-based then following resource is created on subscription level

   resource ServerVulnerabilityAssessmentsSettings 'Microsoft.Security/serverVulnerabilityAssessmentsSettings@2022-01-01-preview' = if (VATool == 'MdeTvm') {
     name: 'AzureServersSetting'
     properties: {
       selectedProvider: 'MdeTvm'
     }
   }

• If you select qualys then policy assignment of 13ce0167-8ca6-4048-8e6b-f996402e3c1b[1] with VaType=default is done on subscription level. This policy just creates Microsoft.Compute/virtualMachines/providers/serverVulnerabilityAssessments extension resource on all VMs

Using defender findind Fix button just deploys Microsoft.Compute/virtualMachines/providers/serverVulnerabilityAssessments on both VA cases (IIRC).

Those resource turns on some automated undocumented processed on Azure/Virtual Machines and then the magic happens if everything works.

Related thread if you have onboarding issues: https://learn.microsoft.com/en-us/answers/questions/1195459/defender-for-cloud-vulnerability-assessment-soluti

[1] https://www.azadvertizer.net/azpolicyadvertizer/13ce0167-8ca6-4048-8e6b-f996402e3c1b.html

Answer 3

This policy is checking if there is an assessment related to a VM of type "Microsoft.Security/assessments" and has a name of "ffff0522-1e88-47fc-8382-2a80ba848f5d".

This assessment is Azure Defender for SQL - SQL Vulnerability Assessment, which can you read more about on Enable vulnerability assessment on your Azure SQL databases. You should be able to pull metadata for Microsoft.Security/assessments by

1. Opening Azure Resource Graph Explorer from the portal
2. Change the scope to the subscription you want to query
3. Run the following query

SecurityResources
| where type == 'Microsoft.Security/assessments'