Azure Audit Securitycenter Monitor Disk Encryption Disabled

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using the Azure console, follow these steps:

Log in to the Azure portal and navigate to the "Security Center" dashboard.
Click on the "Security policy" tab on the left-hand side of the screen.
Under the "Policy initiatives" section, click on the "Enable monitoring of disk encryption" initiative.
Click on the "Remediate" button at the bottom of the screen.
In the pop-up window, review the remediation steps and click on the "Remediate" button again to confirm.
Wait for the remediation process to complete. This may take several minutes.
Once the remediation process is complete, verify that the "Monitor Disk Encryption setting" is now enabled by navigating to the "Security policy" tab and reviewing the policy compliance status.

By following these steps, you should be able to remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using the Azure console.

Using CLI

To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure, you can follow the below steps using Azure CLI:

Open Azure CLI in your terminal or command prompt.
Login to your Azure account using the command:
```
az login
```
Once you are logged in, set the Azure subscription that you want to work with using the command:
```
az account set --subscription <subscription-id>
```
Next, enable the Disk Encryption Monitoring setting for the virtual machines in your Azure account using the command:
```
az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <vm-resource-id> --logs '[{"category": "DiskEncryption", "enabled": true}]'
```
Replace <diagnostic-settings-name> with a name for the diagnostic settings, and <vm-resource-id> with the resource ID of the virtual machine that you want to enable disk encryption monitoring for.

Note: If you want to enable disk encryption monitoring for all virtual machines in your Azure account, you can use the command:
```
az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <vm-resource-id> --logs '[{"category": "DiskEncryption", "enabled": true}]' --scope /subscriptions/<subscription-id>
```
Replace <subscription-id> with your Azure subscription ID.
Verify that the Disk Encryption Monitoring setting is enabled for the virtual machine(s) using the command:
```
az monitor diagnostic-settings show --name <diagnostic-settings-name> --resource <vm-resource-id>
```
This command will show the diagnostic settings for the specified virtual machine, including the Disk Encryption Monitoring setting.

That's it! The "Monitor Disk Encryption setting is not enabled" misconfiguration has been remediated for your Azure virtual machine(s).

Using Python

To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using Python, you can use the Azure Python SDK to enable disk encryption monitoring for all virtual machines in the subscription. Here are the step-by-step instructions:

Install the Azure Python SDK by running the following command in your terminal:
```
pip install azure-mgmt-compute
```
Authenticate with Azure by creating a Service Principal and setting the environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID. You can follow the instructions in the Azure documentation to create a Service Principal: https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#authenticate-with-a-service-principal

Use the following Python code to enable disk encryption monitoring for all virtual machines in the subscription:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import EventData

# Set the credentials and subscription ID
credentials = ServicePrincipalCredentials(
    client_id=os.environ['AZURE_CLIENT_ID'],
    secret=os.environ['AZURE_CLIENT_SECRET'],
    tenant=os.environ['AZURE_TENANT_ID']
)
subscription_id = 'your-subscription-id'

# Create the Compute and Monitor clients
compute_client = ComputeManagementClient(credentials, subscription_id)
monitor_client = MonitorManagementClient(credentials, subscription_id)

# Get all virtual machines in the subscription
vms = compute_client.virtual_machines.list_all()

# Enable disk encryption monitoring for each virtual machine
for vm in vms:
    resource_id = vm.id
    event_data = EventData(
        category='Policy',
        resource_id=resource_id,
        operation_name='Microsoft.Compute/virtualMachines/write',
        status='Succeeded',
        description='Disk encryption monitoring enabled'
    )
    monitor_client.activity_log_alerts.create_or_update(
        resource_group_name='your-resource-group-name',
        activity_log_alert_name='disk-encryption-monitoring',
        condition={
            'all_of': [
                {
                    'field': 'category',
                    'equals': 'Policy'
                },
                {
                    'field': 'resourceId',
                    'equals': resource_id
                },
                {
                    'field': 'operationName',
                    'equals': 'Microsoft.Compute/virtualMachines/write'
                },
                {
                    'field': 'status',
                    'equals': 'Succeeded'
                }
            ]
        },
        enabled=True,
        description='Alert for enabling disk encryption monitoring',
        actions=[event_data],
        tags={}
    )

This code will create an Activity Log alert called "disk-encryption-monitoring" for each virtual machine in the subscription, with the condition that the operation "Microsoft.Compute/virtualMachines/write" succeeds and the resource ID matches the virtual machine. When this condition is met, the alert will trigger an event that enables disk encryption monitoring for the virtual machine.

Save the code to a Python file and run it using the python command in your terminal:
```
python enable_disk_encryption_monitoring.py
```
This will enable disk encryption monitoring for all virtual machines in the subscription.

Using Terraform

resource "azurerm_subscription_policy_assignment" "vm_disk_encryption_monitor" {
  name                 = "vm-disk-encryption-monitor"
  display_name         = "Monitor VM Disk Encryption"
  description          = "Enable Security Center recommendations for virtual machine disk encryption."
  subscription_id      = SUBSCRIPTION_ID # replace with the target subscription ID
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/19a52e8c-f6ed-4528-85a0-8c4bfa0d4c41"

  # Enable the policy so Security Center audits VMs without disk encryption
  parameters = jsonencode({
    effect = {
      value = "AuditIfNotExists"
    }
  })
}

Replace SUBSCRIPTION_ID with the subscription you want Azure Security Center to monitor.
If you already manage this exact policy assignment in Terraform, update its parameters block instead of creating a new resource. Changing only parameters is an in-place update and does not cause downtime.

Verification: terraform plan should show either creation of azurerm_subscription_policy_assignment.vm_disk_encryption_monitor with parameters.effect.value = "AuditIfNotExists", or an update changing the existing assignment’s parameters so that effect is "AuditIfNotExists".

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation