> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Install endpoint protection remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Install Endpoint Protection" in AZURE using the AZURE console, you can follow these step-by-step instructions: 1. Log in to the AZURE portal using your credentials. 2. Navigate to the "Security Center" from the dashboard. 3. Click on the "Recommendations" tab on the left-hand side of the screen. 4. Find the "Install endpoint protection solution on your virtual machines" recommendation and click on it. 5. Review the recommendation details and click on the "Remediate" button at the bottom of the screen. 6. In the "Remediate recommendation" window, select the virtual machines you want to remediate. 7. Choose the endpoint protection solution that you want to install on your virtual machines. 8. Review the remediation details and click on the "Remediate" button to start the remediation process. 9. Wait for the remediation process to complete. Once completed, you can verify that the endpoint protection solution is installed on your virtual machines. By following these steps, you can remediate the misconfiguration "Install Endpoint Protection" in AZURE using the AZURE console. # To remediate the misconfiguration "Install Endpoint Protection" for Azure using Azure CLI, follow these steps: 1. Open the Azure CLI and login to your Azure account. 2. Identify the virtual machine(s) that need endpoint protection installed. You can do this by running the following command: ``` az vm list --query "[].{name:name, osType:storageProfile.osDisk.osType}" --output table ``` This command will list all the virtual machines in your Azure account along with their operating system type. 3. Install the endpoint protection extension on the virtual machine(s) by running the following command: ``` az vm extension set --publisher Microsoft.Azure.Security --name IaaSAntimalware --version 1.15.2.0 --vm-name --resource-group ``` Replace `` with the name of the virtual machine that needs endpoint protection installed and `` with the name of the resource group that the virtual machine is in. 4. Once the extension is installed, you can verify its status by running the following command: ``` az vm extension list --vm-name --resource-group --query "[].{name:name, type:type, provisioningState:provisioningState}" --output table ``` This command will list all the extensions installed on the virtual machine, including the endpoint protection extension. 5. Repeat steps 3 and 4 for all the virtual machines that need endpoint protection installed. 6. Once the endpoint protection extension is installed on all the virtual machines, you should configure it according to your organization's security policies. This may include setting up malware scanning schedules, configuring exclusions, and setting up alerts for malware detections. That's it! By following these steps, you have successfully remediated the misconfiguration "Install Endpoint Protection" for Azure using Azure CLI. To remediate the misconfiguration of not having Endpoint Protection installed in Azure using Python, you can follow these steps: 1. First, you need to import the required libraries and authenticate to your Azure account using the Azure SDK for Python. You can use the following code snippet to do this: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.resource import ResourceManagementClient from azure.mgmt.network import NetworkManagementClient from azure.mgmt.storage import StorageManagementClient credential = DefaultAzureCredential() subscription_id = '' compute_client = ComputeManagementClient(credential, subscription_id) resource_client = ResourceManagementClient(credential, subscription_id) network_client = NetworkManagementClient(credential, subscription_id) storage_client = StorageManagementClient(credential, subscription_id) ``` 2. Once you have authenticated to your Azure account, you can use the `compute_client.virtual_machines.list_all()` method to get a list of all the virtual machines in your subscription. You can then iterate through this list and check if Endpoint Protection is installed on each virtual machine. You can use the following code snippet to do this: ```python theme={null} for vm in compute_client.virtual_machines.list_all(): vm_name = vm.name rg_name = vm.id.split('/')[4] vm_details = compute_client.virtual_machines.get(rg_name, vm_name, expand='instanceView') for ext in vm_details.resources[0].instance_view.extensions: if ext.name == 'Microsoft Antimalware': print(f"Endpoint Protection is already installed on VM {vm_name}") break else: print(f"Endpoint Protection is not installed on VM {vm_name}") ``` 3. If Endpoint Protection is not installed on a virtual machine, you can use the `compute_client.virtual_machines.extensions.create_or_update()` method to install it. You can use the following code snippet to do this: ```python theme={null} for vm in compute_client.virtual_machines.list_all(): vm_name = vm.name rg_name = vm.id.split('/')[4] vm_details = compute_client.virtual_machines.get(rg_name, vm_name, expand='instanceView') for ext in vm_details.resources[0].instance_view.extensions: if ext.name == 'Microsoft Antimalware': print(f"Endpoint Protection is already installed on VM {vm_name}") break else: print(f"Endpoint Protection is not installed on VM {vm_name}") ext_name = 'MicrosoftAntimalware' ext_type = 'IaasAntimalware' ext_location = vm.location ext_settings = { "AntimalwareEnabled": True, "RealtimeProtectionEnabled": True, "ScheduledScanSettings": { "isEnabled": True, "day": "7", "time": "120" } } ext = { "location": ext_location, "publisher": 'Microsoft.Azure.Security', "virtual_machine_extension_type": ext_type, "type_handler_version": '1.14', "auto_upgrade_minor_version": True, "settings": ext_settings } print(f"Installing Endpoint Protection on VM {vm_name}") compute_client.virtual_machines.extensions.create_or_update(rg_name, vm_name, ext_name, ext) ``` Note: This code snippet assumes that you are using the Microsoft Antimalware extension for Endpoint Protection. If you are using a different solution, you will need to modify the code accordingly. 4. Once you have installed Endpoint Protection on all the virtual machines that do not have it, you can verify that it is installed by running the code snippet in step 2 again. By following these steps, you can remediate the misconfiguration of not having Endpoint Protection installed in Azure using Python. ```hcl theme={null} # Existing VM – replace with your actual VM resource and name resource "azurerm_windows_virtual_machine" "MY_VM" { name = "MY_VM_NAME" # replace with your VM name resource_group_name = azurerm_resource_group.MY_RG.name location = azurerm_resource_group.MY_RG.location size = "Standard_B2s" admin_username = "ADMIN_USERNAME" admin_password = "ADMIN_PASSWORD" # ...other required arguments... } # Install Microsoft Antimalware (endpoint protection) via VM Extension resource "azurerm_virtual_machine_extension" "MY_VM_ANTIMALWARE" { name = "IaaSAntimalware" virtual_machine_id = azurerm_windows_virtual_machine.MY_VM.id publisher = "Microsoft.Azure.Security" type = "IaaSAntimalware" type_handler_version = "1.5" auto_upgrade_minor_version = true settings = jsonencode({ AntimalwareEnabled = true RealtimeProtectionEnabled = true ScheduledScanSettings = { isEnabled = true day = 7 # 0–7, where 7 = every day; adjust as required time = 120 # minutes after midnight; adjust as required scanType = "Quick" # or "Full" } Exclusions = { Extensions = "" # add comma‑separated extensions to exclude if needed Paths = "" # add semicolon‑separated paths to exclude if needed Processes = "" # add semicolon‑separated processes to exclude if needed } }) } ``` This change does not replace the VM; it adds an extension to install and manage endpoint protection on the existing virtual machine. Verification: `terraform plan` should show a single `+ create` for `azurerm_virtual_machine_extension.MY_VM_ANTIMALWARE` and no `- destroy` or `-/+ replace` for the VM resource.