> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor OS Vulnerabilities setting is not enabled

### More Info:

Enable OS Vulnerabilities recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA
* ISO 27001
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor OS Vulnerabilities setting is not enabled" misconfiguration in Azure using the Azure console, you can follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).

        2. Navigate to the Azure Security Center from the left-hand menu.

        3. Click on the "Security policy" tab.

        4. Select the subscription you want to remediate.

        5. Click on the "Edit" button next to the security policy.

        6. Scroll down to the "Endpoint protection" section.

        7. Under "Operating system vulnerabilities", make sure the "Monitor" setting is enabled.

        8. If it is not enabled, click on the "On" button to enable it.

        9. Click on the "Save" button to save the changes.

        10. Wait for the changes to take effect.

        Once these steps are completed, the "Monitor OS Vulnerabilities setting is not enabled" misconfiguration will be remediated in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor OS Vulnerabilities setting is not enabled" misconfiguration in AZURE using AZURE CLI, follow the below steps:

        1. Open the AZURE CLI and login to your AZURE account using the command `az login`.

        2. Once you are successfully logged in, run the command `az account set --subscription <subscription_id>` to set your subscription ID.

        3. Next, run the command `az policy definition create --name 'Monitor-OS-Vulnerabilities' --mode All --rules 'https://raw.githubusercontent.com/Azure/azure-policy/master/samples/Compute/monitor-vm-os-vulnerabilities/azurepolicy.rules.json' --params 'https://raw.githubusercontent.com/Azure/azure-policy/master/samples/Compute/monitor-vm-os-vulnerabilities/azurepolicy.parameters.json' --display-name 'Monitor OS Vulnerabilities' --description 'This policy enables monitoring of OS vulnerabilities on virtual machines'` to create a new policy definition.

        4. After the policy definition is created, assign it to the scope where you want to enable the "Monitor OS Vulnerabilities" setting. For example, to assign it to a resource group, run the command `az policy assignment create --name 'Monitor-OS-Vulnerabilities-Assignment' --scope /subscriptions/<subscription_id>/resourceGroups/<resource_group_name> --policy 'Monitor-OS-Vulnerabilities'`.

        5. Finally, verify that the policy assignment is successfully applied by running the command `az policy assignment show --name 'Monitor-OS-Vulnerabilities-Assignment' --query 'properties.status.message'`. The output should show "Policy assignment is compliant" which means the "Monitor OS Vulnerabilities" setting is enabled.

        By following these steps, you can remediate the "Monitor OS Vulnerabilities setting is not enabled" misconfiguration in AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor OS Vulnerabilities setting is not enabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python. Here are the step-by-step instructions:

        1. Install the Azure SDK for Python using pip:

        ```python theme={null}
        pip install azure-mgmt-monitor
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.monitor import MonitorManagementClient
        ```

        3. Authenticate to Azure using a service principal:

        ```python theme={null}
        credentials = ServicePrincipalCredentials(
            client_id='<your-client-id>',
            secret='<your-client-secret>',
            tenant='<your-tenant-id>'
        )
        ```

        4. Instantiate the `MonitorManagementClient` using the authenticated credentials:

        ```python theme={null}
        client = MonitorManagementClient(credentials, '<your-subscription-id>')
        ```

        5. Get the existing diagnostic settings for the resource you want to remediate:

        ```python theme={null}
        resource_id = '/subscriptions/<your-subscription-id>/resourceGroups/<your-resource-group>/providers/Microsoft.Compute/virtualMachines/<your-vm-name>'
        settings = client.diagnostic_settings.list(resource_id)
        ```

        6. Check if the "Security" diagnostic setting is already enabled:

        ```python theme={null}
        security_setting = next((s for s in settings if s.name.value == 'Security'), None)
        if security_setting and security_setting.enabled:
            print('Security diagnostic setting is already enabled')
        else:
            print('Security diagnostic setting is not enabled')
        ```

        7. If the "Security" diagnostic setting is not enabled, enable it:

        ```python theme={null}
        if not security_setting:
            security_setting = client.diagnostic_settings.create_or_update(
                resource_id,
                'Security',
                {
                    'event_hub_name': '<your-event-hub-name>',
                    'event_hub_authorization_rule_id': '<your-event-hub-auth-rule-id>',
                    'logs': [
                        {
                            'category': 'Security',
                            'enabled': True,
                            'retentionPolicy': {
                                'enabled': True,
                                'days': 30
                            }
                        }
                    ],
                    'metrics': []
                }
            )
            print('Security diagnostic setting enabled')
        else:
            security_setting.enabled = True
            security_setting = client.diagnostic_settings.create_or_update(resource_id, 'Security', security_setting)
            print('Security diagnostic setting updated')
        ```

        Note: Replace `<your-client-id>`, `<your-client-secret>`, `<your-tenant-id>`, `<your-subscription-id>`, `<your-resource-group>`, `<your-vm-name>`, `<your-event-hub-name>`, and `<your-event-hub-auth-rule-id>` with your own values.

        These steps will enable the "Monitor OS Vulnerabilities" setting for the specified virtual machine in Azure.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This specific “Monitor OS Vulnerabilities” toggle in Microsoft Defender for Cloud
        # is not exposed by the current azurerm provider, so it cannot be managed on
        # the `azurerm_security_center_*` or any “securitycenter-policyassignment” resource
        # in Terraform.

        # You must enable it manually in the Azure Portal:
        # 1. Go to "Microsoft Defender for Cloud".
        # 2. Open "Environment settings".
        # 3. Select the SUBSCRIPTION where the finding was raised.
        # 4. Under the relevant plan (e.g., Defender for Servers), enable
        #    the OS vulnerabilities monitoring / recommendations setting and save.

        # No Terraform resource or argument exists today that maps to this exact setting,
        # so there is nothing for `terraform plan` to show for this change.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>