> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit securitycenter monitor disk encryption disabled remediation ### Triage and Remediation ### Remediation To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using the Azure console, follow these steps: 1. Log in to the Azure portal and navigate to the "Security Center" dashboard. 2. Click on the "Security policy" tab on the left-hand side of the screen. 3. Under the "Policy initiatives" section, click on the "Enable monitoring of disk encryption" initiative. 4. Click on the "Remediate" button at the bottom of the screen. 5. In the pop-up window, review the remediation steps and click on the "Remediate" button again to confirm. 6. Wait for the remediation process to complete. This may take several minutes. 7. Once the remediation process is complete, verify that the "Monitor Disk Encryption setting" is now enabled by navigating to the "Security policy" tab and reviewing the policy compliance status. By following these steps, you should be able to remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using the Azure console. # To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure, you can follow the below steps using Azure CLI: 1. Open Azure CLI in your terminal or command prompt. 2. Login to your Azure account using the command: ``` az login ``` 3. Once you are logged in, set the Azure subscription that you want to work with using the command: ``` az account set --subscription ``` 4. Next, enable the Disk Encryption Monitoring setting for the virtual machines in your Azure account using the command: ``` az monitor diagnostic-settings create --name --resource --logs '[{"category": "DiskEncryption", "enabled": true}]' ``` Replace `` with a name for the diagnostic settings, and `` with the resource ID of the virtual machine that you want to enable disk encryption monitoring for. Note: If you want to enable disk encryption monitoring for all virtual machines in your Azure account, you can use the command: ``` az monitor diagnostic-settings create --name --resource --logs '[{"category": "DiskEncryption", "enabled": true}]' --scope /subscriptions/ ``` Replace `` with your Azure subscription ID. 5. Verify that the Disk Encryption Monitoring setting is enabled for the virtual machine(s) using the command: ``` az monitor diagnostic-settings show --name --resource ``` This command will show the diagnostic settings for the specified virtual machine, including the Disk Encryption Monitoring setting. That's it! The "Monitor Disk Encryption setting is not enabled" misconfiguration has been remediated for your Azure virtual machine(s). To remediate the "Monitor Disk Encryption setting is not enabled" misconfiguration in Azure using Python, you can use the Azure Python SDK to enable disk encryption monitoring for all virtual machines in the subscription. Here are the step-by-step instructions: 1. Install the Azure Python SDK by running the following command in your terminal: ``` pip install azure-mgmt-compute ``` 2. Authenticate with Azure by creating a Service Principal and setting the environment variables `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, and `AZURE_TENANT_ID`. You can follow the instructions in the Azure documentation to create a Service Principal: [https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#authenticate-with-a-service-principal](https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#authenticate-with-a-service-principal) 3. Use the following Python code to enable disk encryption monitoring for all virtual machines in the subscription: ```python theme={null} from azure.common.credentials import ServicePrincipalCredentials from azure.mgmt.compute import ComputeManagementClient from azure.mgmt.monitor import MonitorManagementClient from azure.mgmt.monitor.models import EventData # Set the credentials and subscription ID credentials = ServicePrincipalCredentials( client_id=os.environ['AZURE_CLIENT_ID'], secret=os.environ['AZURE_CLIENT_SECRET'], tenant=os.environ['AZURE_TENANT_ID'] ) subscription_id = 'your-subscription-id' # Create the Compute and Monitor clients compute_client = ComputeManagementClient(credentials, subscription_id) monitor_client = MonitorManagementClient(credentials, subscription_id) # Get all virtual machines in the subscription vms = compute_client.virtual_machines.list_all() # Enable disk encryption monitoring for each virtual machine for vm in vms: resource_id = vm.id event_data = EventData( category='Policy', resource_id=resource_id, operation_name='Microsoft.Compute/virtualMachines/write', status='Succeeded', description='Disk encryption monitoring enabled' ) monitor_client.activity_log_alerts.create_or_update( resource_group_name='your-resource-group-name', activity_log_alert_name='disk-encryption-monitoring', condition={ 'all_of': [ { 'field': 'category', 'equals': 'Policy' }, { 'field': 'resourceId', 'equals': resource_id }, { 'field': 'operationName', 'equals': 'Microsoft.Compute/virtualMachines/write' }, { 'field': 'status', 'equals': 'Succeeded' } ] }, enabled=True, description='Alert for enabling disk encryption monitoring', actions=[event_data], tags={} ) ``` This code will create an Activity Log alert called "disk-encryption-monitoring" for each virtual machine in the subscription, with the condition that the operation "Microsoft.Compute/virtualMachines/write" succeeds and the resource ID matches the virtual machine. When this condition is met, the alert will trigger an event that enables disk encryption monitoring for the virtual machine. 4. Save the code to a Python file and run it using the `python` command in your terminal: ``` python enable_disk_encryption_monitoring.py ``` This will enable disk encryption monitoring for all virtual machines in the subscription. ```hcl theme={null} resource "azurerm_subscription_policy_assignment" "vm_disk_encryption_monitor" { name = "vm-disk-encryption-monitor" display_name = "Monitor VM Disk Encryption" description = "Enable Security Center recommendations for virtual machine disk encryption." subscription_id = SUBSCRIPTION_ID # replace with the target subscription ID policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/19a52e8c-f6ed-4528-85a0-8c4bfa0d4c41" # Enable the policy so Security Center audits VMs without disk encryption parameters = jsonencode({ effect = { value = "AuditIfNotExists" } }) } ``` * Replace `SUBSCRIPTION_ID` with the subscription you want Azure Security Center to monitor. * If you already manage this exact policy assignment in Terraform, update its `parameters` block instead of creating a new resource. Changing only `parameters` is an in-place update and does not cause downtime. Verification: `terraform plan` should show either creation of `azurerm_subscription_policy_assignment.vm_disk_encryption_monitor` with `parameters.effect.value = "AuditIfNotExists"`, or an update changing the existing assignment’s `parameters` so that `effect` is `"AuditIfNotExists"`.