Monitor Endpoint Protection setting is not enabled
More Info:
Enable Endpoint Protection recommendations for virtual machines.Risk Level
LowAddress
Security, Operational MaturityCompliance Standards
HIPAA, ISO27001Triage and Remediation
Remediation
Using Console
Using Console
To remediate the “Monitor Endpoint Protection setting is not enabled” misconfiguration in Azure using the Azure console, you can follow these steps:
- Log in to the Azure portal and navigate to the Security Center.
- Click on the “Security policy” tab on the left-hand side menu.
- Scroll down to the “Endpoint protection” section and click on the “Edit” button.
- Under the “Antivirus protection” section, ensure that the “Monitor endpoint protection” setting is enabled.
- If the setting is not enabled, click on the toggle switch to turn it on.
- Click “Save” to apply the changes.
- Wait for the changes to propagate, which may take a few minutes.
- Verify that the “Monitor endpoint protection” setting is now enabled by checking the “Endpoint protection” section in the Security policy tab.
Using CLI
Using CLI
To remediate the misconfiguration “Monitor Endpoint Protection setting is not enabled” for Azure using Azure CLI, you can follow the below steps:
- Open the Azure CLI and log in to your Azure account.
-
Run the following command to enable the endpoint protection setting for your Azure virtual machines:
Replace
<vm-name>with the name of your virtual machine and<resource-group-name>with the name of the resource group where the virtual machine is located. - Once the command is executed successfully, the endpoint protection setting will be enabled for your Azure virtual machine.
-
To verify the configuration, run the following command:
This command will return the value “true” if the endpoint protection setting is enabled for your virtual machine.
Using Python
Using Python
To remediate the “Monitor Endpoint Protection setting is not enabled” misconfiguration in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:This will enable the “Monitor Endpoint Protection” setting in the security policy for the target Azure subscription.
- Import the necessary modules:
- Authenticate with Azure using the
DefaultAzureCredentialclass:
- Instantiate a
SecurityCenterclient object:
- Get the subscription ID for the target subscription:
- Get the security policy for the subscription:
- Check if the “Monitor Endpoint Protection” setting is enabled:
- Update the security policy with the new setting: