> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor System Updates setting is not enabled

### More Info:

Enable System Updates recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA
* ISO 27001
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor System Updates setting is not enabled" misconfiguration in Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).
        2. Navigate to the virtual machine that needs to be remediated.
        3. Click on the "Security" tab in the left-hand menu.
        4. Click on the "Security Center" link.
        5. This will open the Azure Security Center. Click on the "Recommendations" tab.
        6. Find the recommendation "Enable monitoring of system updates on virtual machines" and click on it.
        7. This will open the recommendation details page. Click on the "Remediate" button.
        8. In the "Remediate recommendation" window, select the virtual machine that needs to be remediated and click on the "Remediate" button.
        9. Wait for the remediation to complete. This may take several minutes.
        10. Once the remediation is complete, refresh the page to ensure that the "Monitor System Updates" setting is now enabled.

        Following these steps will remediate the "Monitor System Updates setting is not enabled" misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor System Updates setting is not enabled" misconfiguration in Azure using Azure CLI, follow the steps below:

        1. Open the Azure CLI on your local machine or in the Azure Portal.

        2. Run the following command to check the current status of the "Monitor System Updates" setting:

           ```
           az vm get-instance-view --resource-group <resource-group-name> --name <vm-name> --query "instanceView.extensions[?type=='Microsoft.Azure.Security.AzureSecurityCenter'].settings"
           ```

           Replace `<resource-group-name>` and `<vm-name>` with the name of the resource group and virtual machine that you want to check.

        3. If the "Monitor System Updates" setting is not enabled, run the following command to enable it:

           ```
           az vm extension set --resource-group <resource-group-name> --vm-name <vm-name> --name AzureSecurityCenter --publisher Microsoft.Azure.Security --settings "{'monitorWindowsUpdates': true, 'monitorLinuxUpdates': true}"
           ```

           Replace `<resource-group-name>` and `<vm-name>` with the name of the resource group and virtual machine that you want to remediate.

        4. Once the command is executed successfully, the "Monitor System Updates" setting will be enabled for the virtual machine.

        Note: The Azure Security Center must be enabled for the subscription and the virtual machine for this remediation to work.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor System Updates setting is not enabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python. Here are the step by step instructions:

        1. Install the Azure SDK for Python using the following command:

           ```
           pip install azure-mgmt-monitor
           ```

        2. Authenticate with Azure using your Azure credentials. You can use the following code to authenticate:

           ```
           from azure.identity import DefaultAzureCredential
           from azure.mgmt.monitor import MonitorManagementClient
           from azure.mgmt.resource import SubscriptionClient

           credential = DefaultAzureCredential()
           subscription_client = SubscriptionClient(credential)
           subscription = next(subscription_client.subscriptions.list())
           monitor_client = MonitorManagementClient(credential, subscription.subscription_id)
           ```

        3. Get the current configuration for the Monitor System Updates setting using the following code:

           ```
           settings = monitor_client.diagnostic_settings.list(resource_uri='/', metric_namespace='Microsoft.Insights', metric_name='Heartbeat')
           for setting in settings:
               if setting.workspace_id:
                   print(f"Workspace ID: {setting.workspace_id}")
                   print(f"Log Analytics Solution Enabled: {setting.enabled}")
           ```

        4. If the "Log Analytics Solution Enabled" value is False, then the Monitor System Updates setting is not enabled. To remediate this, you can enable the setting using the following code:

           ```
           from azure.mgmt.monitor.models import LogAnalyticsDestinationDetails, DiagnosticSettingsCategoryResource

           workspace_id = "<your workspace ID>"
           log_analytics_destination = LogAnalyticsDestinationDetails(workspace_id=workspace_id)
           category = DiagnosticSettingsCategoryResource(enabled=True, name='Heartbeat', destinations=[log_analytics_destination])
           monitor_client.diagnostic_settings.create_or_update(resource_uri='/', settings_name='Heartbeat', parameters={'categories': [category]})
           ```

           Replace `<your workspace ID>` with the ID of your Log Analytics workspace.

        5. After running the remediation code, you can verify that the setting is enabled by running the code in step 3 again and checking that the "Log Analytics Solution Enabled" value is True.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_policy_assignment" "monitor_system_updates" {
          name                 = "monitor-system-updates"
          scope                = "/subscriptions/${var.SUBSCRIPTION_ID}" # replace var.SUBSCRIPTION_ID
          location             = "LOCATION_FOR_MANAGED_IDENTITY"         # e.g. "westeurope" if required
          display_name         = "Monitor system updates on virtual machines"
          description          = "Enable Security Center system updates recommendations for VMs"
          enforcement_mode     = "Default"
          identity {
            type = "SystemAssigned"
          }

          # Replace POLICY_DEFINITION_ID with the ID of the built‑in (or custom) policy/initiative
          # that controls 'Monitor system updates' in Microsoft Defender for Cloud
          policy_definition_id = "POLICY_DEFINITION_OR_INITIATIVE_ID"

          # The parameters block must match the definition's schema.
          # Replace PARAMETER_NAME and VALUE_WITH_SYSTEM_UPDATES_ENABLED
          parameters = jsonencode({
            "PARAMETER_NAME_FOR_SYSTEM_UPDATES" = {
              "value" = "VALUE_THAT_ENABLES_SYSTEM_UPDATES" # e.g. "On" or true, per policy definition
            }
          })
        }
        ```

        There is no dedicated Terraform argument to toggle “Monitor System Updates” directly on a `security center` resource; it is controlled via a policy/initiative assignment, so you must attach the correct built‑in (or custom) policy that enables this recommendation and set its parameter(s) accordingly in `parameters`.

        This change updates the existing assignment in place (no forced replacement) as long as `name` and `scope` stay the same; only the policy and/or parameters will change.

        To verify, `terraform plan` should show an update to the `azurerm_policy_assignment.monitor_system_updates` resource with changes to `policy_definition_id` and/or `parameters`, and no resources marked `-/+` (destroy/create).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>