> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor Endpoint Protection setting is not enabled

### More Info:

Enable Endpoint Protection recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA
* ISO 27001

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor Endpoint Protection setting is not enabled" misconfiguration in Azure using the Azure console, you can follow these steps:

        1. Log in to the Azure portal and navigate to the Security Center.

        2. Click on the "Security policy" tab on the left-hand side menu.

        3. Scroll down to the "Endpoint protection" section and click on the "Edit" button.

        4. Under the "Antivirus protection" section, ensure that the "Monitor endpoint protection" setting is enabled.

        5. If the setting is not enabled, click on the toggle switch to turn it on.

        6. Click "Save" to apply the changes.

        7. Wait for the changes to propagate, which may take a few minutes.

        8. Verify that the "Monitor endpoint protection" setting is now enabled by checking the "Endpoint protection" section in the Security policy tab.

        By following these steps, you should be able to remediate the "Monitor Endpoint Protection setting is not enabled" misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Monitor Endpoint Protection setting is not enabled" for Azure using Azure CLI, you can follow the below steps:

        1. Open the Azure CLI and log in to your Azure account.

        2. Run the following command to enable the endpoint protection setting for your Azure virtual machines:

           ```
           az vm update --name <vm-name> --resource-group <resource-group-name> --set diagnosticsProfile.bootDiagnostics.enabled=true
           ```

           Replace `<vm-name>` with the name of your virtual machine and `<resource-group-name>` with the name of the resource group where the virtual machine is located.

        3. Once the command is executed successfully, the endpoint protection setting will be enabled for your Azure virtual machine.

        4. To verify the configuration, run the following command:

           ```
           az vm show --name <vm-name> --resource-group <resource-group-name> --query 'diagnosticsProfile.bootDiagnostics.enabled'
           ```

           This command will return the value "true" if the endpoint protection setting is enabled for your virtual machine.

        By following these steps, you can remediate the misconfiguration "Monitor Endpoint Protection setting is not enabled" for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor Endpoint Protection setting is not enabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

        1. Import the necessary modules:

        ```python theme={null}
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.security import SecurityCenter
        ```

        2. Authenticate with Azure using the `DefaultAzureCredential` class:

        ```python theme={null}
        credential = DefaultAzureCredential()
        ```

        3. Instantiate a `SecurityCenter` client object:

        ```python theme={null}
        security_center_client = SecurityCenter(security_center_subscription_id, credential)
        ```

        4. Get the subscription ID for the target subscription:

        ```python theme={null}
        subscription_id = security_center_client.subscriptions.get().id
        ```

        5. Get the security policy for the subscription:

        ```python theme={null}
        policy = security_center_client.policies.get(subscription_id, 'default')
        ```

        6. Check if the "Monitor Endpoint Protection" setting is enabled:

        ```python theme={null}
        setting = next((s for s in policy.settings if s.name == 'MonitorEndpointProtection'), None)
        if setting.value == 'Off':
            setting.value = 'On'
        ```

        7. Update the security policy with the new setting:

        ```python theme={null}
        security_center_client.policies.create_or_update(subscription_id, 'default', policy)
        ```

        This will enable the "Monitor Endpoint Protection" setting in the security policy for the target Azure subscription.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_policy_assignment" "monitor_endpoint_protection" {
          name                 = "monitor-endpoint-protection"
          display_name         = "Monitor Endpoint Protection on Virtual Machines"
          description          = "Enable Endpoint Protection recommendations for virtual machines in Defender for Cloud."
          scope                = "/subscriptions/${data.azurerm_client_config.current.subscription_id}" # or a specific resource group/management group scope
          policy_definition_id = "POLICY_DEFINITION_ID_FOR_MONITOR_ENDPOINT_PROTECTION"               # replace with the built‑in policy/initiative ID from the portal

          # Parameters depend on the specific built-in policy/initiative you use.
          # Use the exact parameter names and allowed values from that definition.
          parameters = jsonencode({
            # Example – adjust to match the chosen policy/initiative:
            "effect" = {
              "value" = "AuditIfNotExists" # or "DeployIfNotExists" if required by your standard
            }
            # Add any other required parameters here, for example:
            # "listOfLocations" = { "value" = ["westeurope", "eastus"] }
          })

          # Optional: ensure policy enforcement is on
          enforce = true
        }

        data "azurerm_client_config" "current" {}
        ```

        If you already have an `azurerm_policy_assignment` for this control, update that existing resource with the correct `policy_definition_id` and `parameters` instead of creating a new one; this will be an in‑place update, not a replacement of any VM resources.

        Verification with `terraform plan` should show either:

        * `+` creation of `azurerm_policy_assignment.monitor_endpoint_protection`, or
        * `~` an update to the existing policy assignment, changing `policy_definition_id`, `parameters`, and/or `enforce` to the desired values.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>