Remediate machine vulnerabilities

The Defender for Servers plan in Microsoft Defender for Cloud scans protected machines for vulnerabilities. It supports both agentless and agent-based scanning through Microsoft Defender Vulnerability Management.

Requirement	Details
Plan	For agentless scanning, enable Defender for Servers Plan 2 and turn on agentless scanning in the plan. For agent-based scanning, enable Defender for Servers Plan 1 or Plan 2 and turn on Defender for Endpoint integration.
Agentless scanning	Review the prerequisites for agentless scanning.
Agent-based scanning	Review the prerequisites for Defender for Endpoint integration in Defender for Servers.

View scan findings

To review and remediate machine vulnerability findings:

1. In Defender for Cloud, go to Recommendations.

2. Select Vulnerabilities to view vulnerability recommendations.

3. Use the available filters to scope the results to the resources you want to review.

4. To review vulnerability findings for a specific resource, select Group by resource, and then select the resource.

5. Select an individual vulnerability recommendation to review its details.

6. Review the recommendation details, including:

   • The affected resource
   • Relevant CVEs, when available
   • Remediation steps
   • Additional reference information, when available

7. To remediate the finding, follow the remediation guidance for the selected recommendation.

Export the results

You can use Azure Resource Graph to query and export machine vulnerability findings across your environment.

The following query returns individual software update recommendations for Azure virtual machines:

securityresources
| where type == "microsoft.security/assessments"
| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"
| where properties.metadata.recommendationCategory == "SoftwareUpdate"
| extend DisplayName = tostring(properties.displayName)
| extend Severity = tostring(properties.metadata.severity)
| extend DetectedVersions = tostring(properties.additionalData.DetectedSoftwareVersions)
| extend FixedVersion = tostring(properties.additionalData.FixedVersion)
| extend CvesDetails = parse_json(tostring(properties.additionalData.CvesDetails))
| mv-expand CveDetail = CvesDetails
| extend CveId = tostring(CveDetail.CveId)
| project DisplayName, Severity, DetectedVersions, FixedVersion, CveId

Note

The CvesDetails object continues to provide the CveId for each vulnerability. To retrieve additional CVE details, query the microsoft.security/cvedetails resource type:

securityresources
| where type =~ "microsoft.security/cvedetails"

For more information about migrating Azure Resource Graph queries to individual recommendations, see Transition from grouped to individual recommendations.

Next steps

Review security recommendations