Monitor Vulnerability Assessment setting is not enabled

More Info:

Enable Vulnerability Assessment recommendations for virtual machines.

Risk Level

Low

Address

Security, Operational Maturity

Compliance Standards

CISAZURE, CBP, SOC2, ISO27001, HIPAA

Triage and Remediation

Remediation

Using Console

Using CLI

Using Python

To remediate the “Monitor Vulnerability Assessment setting is not enabled” misconfiguration in Azure using Python, you can use the Azure SDK for Python to enable the vulnerability assessment setting for the specified Azure SQL Database. Here are the step-by-step instructions:

Install the Azure SDK for Python using pip:

pip install azure-mgmt-sql

Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.sql import SqlManagementClient
from azure.mgmt.sql.models import VulnerabilityAssessmentPolicy, ServerSecurityAlertPolicy, \
    ServerVulnerabilityAssessmentSettings

Set up the Azure credentials:

credentials = ServicePrincipalCredentials(
    client_id='<YOUR_CLIENT_ID>',
    secret='<YOUR_SECRET>',
    tenant='<YOUR_TENANT_ID>'
)

Create a SqlManagementClient object:

sql_client = SqlManagementClient(credentials, '<YOUR_SUBSCRIPTION_ID>')

Get the current vulnerability assessment settings for the specified Azure SQL Database:

resource_group_name = '<YOUR_RESOURCE_GROUP_NAME>'
server_name = '<YOUR_SERVER_NAME>'
database_name = '<YOUR_DATABASE_NAME>'

vulnerability_assessment_settings = sql_client.vulnerability_assessments.get(
    resource_group_name=resource_group_name,
    server_name=server_name,
    database_name=database_name
).as_dict()

Check if the vulnerability assessment setting is already enabled:

if vulnerability_assessment_settings['properties']['state'] == 'Enabled':
    print('Vulnerability assessment setting is already enabled.')
    exit()

If the vulnerability assessment setting is not enabled, create a new vulnerability assessment policy object:

vulnerability_assessment_policy = VulnerabilityAssessmentPolicy(
    storage_account_access_key='<YOUR_STORAGE_ACCOUNT_ACCESS_KEY>',
    storage_container_path='<YOUR_STORAGE_CONTAINER_PATH>',
    recurring_scans={
        'isEnabled': True,
        'emailSubscriptionAdmins': False,
        'emailSubscriptionOwners': False,
        'emailAddresses': []
    },
    notifications={
        'emailAdmins': False,
        'emailOwners': False,
        'includeFailures': False,
        'customEmailAddresses': []
    }
)

Create a new server security alert policy object:

server_security_alert_policy = ServerSecurityAlertPolicy(
    state='Enabled',
    disabled_alerts=[],
    email_account_admins=False,
    retention_days=90
)

Create a new server vulnerability assessment settings object with the new policy objects:

server_vulnerability_assessment_settings = ServerVulnerabilityAssessmentSettings(
    name='default',
    storage_account_access_key='<YOUR_STORAGE_ACCOUNT_ACCESS_KEY>',
    storage_container_path='<YOUR_STORAGE_CONTAINER_PATH>',
    vulnerability_assessment_policy=vulnerability_assessment_policy,
    security_alert_policy=server_security_alert_policy
)

Update the vulnerability assessment settings for the specified Azure SQL Database:

sql_client.vulnerability_assessments.create_or_update(
    resource_group_name=resource_group_name,
    server_name=server_name,
    database_name=database_name,
    parameters=server_vulnerability_assessment_settings
)

This will enable the vulnerability assessment setting for the specified Azure SQL Database.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Monitor Vulnerability Assessment setting is not enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation