> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor Vulnerability Assessment setting is not enabled

### More Info:

Enable Vulnerability Assessment recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* CIS AZURE
* Cloudanix Best Practice
* HIPAA
* ISO 27001
* SOC2

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of Monitor Vulnerability Assessment setting not enabled in Azure, please follow the below steps:

        1. Open the Azure portal and sign in with your credentials.
        2. From the Azure dashboard, click on the "Security Center" icon.
        3. In the Security Center, navigate to the "Security policy" tab.
        4. Under the "Security policy" tab, click on the "Edit" button to modify the policy.
        5. Scroll down to the "Vulnerability assessment" section and click on the "On" button to enable the "Monitor Vulnerability Assessment" setting.
        6. After enabling the setting, click on the "Save" button to save the changes.

        Once the above steps are completed, the "Monitor Vulnerability Assessment" setting will be enabled in Azure, and the system will start monitoring for vulnerabilities. It is recommended to periodically review the security policies to ensure that they are up to date and provide adequate protection against potential threats.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor Vulnerability Assessment setting is not enabled" misconfiguration for Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI and login to your Azure account using the command `az login`.

        2. Once you are logged in, run the command `az account list` to list all the subscriptions associated with your account.

        3. Identify the subscription for which you want to enable the Monitor Vulnerability Assessment setting and set it as the default subscription using the command `az account set --subscription <subscription-id>`.

        4. Run the command `az policy definition list` to list all the policy definitions available in your subscription.

        5. Identify the policy definition for the Monitor Vulnerability Assessment setting. You can use the command `az policy definition show --name <policy-name>` to view the details of a specific policy definition.

        6. Once you have identified the policy definition, assign it to the appropriate scope. For example, to assign the policy definition to a resource group, use the command `az policy assignment create --name <assignment-name> --scope <resource-group-id> --policy <policy-name>`.

        7. Verify that the policy assignment has been created successfully using the command `az policy assignment show --name <assignment-name> --scope <resource-group-id>`.

        8. Finally, wait for the policy to be enforced. The time it takes for the policy to be enforced depends on the scope of the policy assignment.

        By following these steps, you should be able to remediate the "Monitor Vulnerability Assessment setting is not enabled" misconfiguration for Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor Vulnerability Assessment setting is not enabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python to enable the vulnerability assessment setting for the specified Azure SQL Database. Here are the step-by-step instructions:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-mgmt-sql
        ```

        2. Import the necessary modules:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.sql import SqlManagementClient
        from azure.mgmt.sql.models import VulnerabilityAssessmentPolicy, ServerSecurityAlertPolicy, \
            ServerVulnerabilityAssessmentSettings
        ```

        3. Set up the Azure credentials:

        ```python theme={null}
        credentials = ServicePrincipalCredentials(
            client_id='<YOUR_CLIENT_ID>',
            secret='<YOUR_SECRET>',
            tenant='<YOUR_TENANT_ID>'
        )
        ```

        4. Create a SqlManagementClient object:

        ```python theme={null}
        sql_client = SqlManagementClient(credentials, '<YOUR_SUBSCRIPTION_ID>')
        ```

        5. Get the current vulnerability assessment settings for the specified Azure SQL Database:

        ```python theme={null}
        resource_group_name = '<YOUR_RESOURCE_GROUP_NAME>'
        server_name = '<YOUR_SERVER_NAME>'
        database_name = '<YOUR_DATABASE_NAME>'

        vulnerability_assessment_settings = sql_client.vulnerability_assessments.get(
            resource_group_name=resource_group_name,
            server_name=server_name,
            database_name=database_name
        ).as_dict()
        ```

        6. Check if the vulnerability assessment setting is already enabled:

        ```python theme={null}
        if vulnerability_assessment_settings['properties']['state'] == 'Enabled':
            print('Vulnerability assessment setting is already enabled.')
            exit()
        ```

        7. If the vulnerability assessment setting is not enabled, create a new vulnerability assessment policy object:

        ```python theme={null}
        vulnerability_assessment_policy = VulnerabilityAssessmentPolicy(
            storage_account_access_key='<YOUR_STORAGE_ACCOUNT_ACCESS_KEY>',
            storage_container_path='<YOUR_STORAGE_CONTAINER_PATH>',
            recurring_scans={
                'isEnabled': True,
                'emailSubscriptionAdmins': False,
                'emailSubscriptionOwners': False,
                'emailAddresses': []
            },
            notifications={
                'emailAdmins': False,
                'emailOwners': False,
                'includeFailures': False,
                'customEmailAddresses': []
            }
        )
        ```

        8. Create a new server security alert policy object:

        ```python theme={null}
        server_security_alert_policy = ServerSecurityAlertPolicy(
            state='Enabled',
            disabled_alerts=[],
            email_account_admins=False,
            retention_days=90
        )
        ```

        9. Create a new server vulnerability assessment settings object with the new policy objects:

        ```python theme={null}
        server_vulnerability_assessment_settings = ServerVulnerabilityAssessmentSettings(
            name='default',
            storage_account_access_key='<YOUR_STORAGE_ACCOUNT_ACCESS_KEY>',
            storage_container_path='<YOUR_STORAGE_CONTAINER_PATH>',
            vulnerability_assessment_policy=vulnerability_assessment_policy,
            security_alert_policy=server_security_alert_policy
        )
        ```

        10. Update the vulnerability assessment settings for the specified Azure SQL Database:

        ```python theme={null}
        sql_client.vulnerability_assessments.create_or_update(
            resource_group_name=resource_group_name,
            server_name=server_name,
            database_name=database_name,
            parameters=server_vulnerability_assessment_settings
        )
        ```

        This will enable the vulnerability assessment setting for the specified Azure SQL Database.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_subscription_policy_assignment" "monitor_vulnerability_assessment" {
          name            = "MonitorVulnerabilityAssessmentOnVMs"
          subscription_id = "/subscriptions/SUBSCRIPTION_ID" # replace with your subscription ID

          # Built-in policy definition that enables Vulnerability Assessment
          # for virtual machines in Microsoft Defender for Cloud (Security Center).
          # Replace POLICY_DEFINITION_ID with the actual policy definition ID you use.
          policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/POLICY_DEFINITION_ID"

          display_name = "Monitor Vulnerability Assessment on virtual machines"
          description  = "Enable Vulnerability Assessment recommendations for virtual machines in Azure Security Center."
        }
        ```

        * Replace `SUBSCRIPTION_ID` with your subscription GUID (no surrounding `{}`).
        * Replace `POLICY_DEFINITION_ID` with the exact ID of the Azure Policy definition that enforces “Enable/Monitor Vulnerability Assessment recommendations for virtual machines”.

        Changing `name`, `subscription_id`, or `policy_definition_id` on an existing assignment will force replacement of the policy assignment, which may briefly drop the old assignment before the new one is created.

        For verification, `terraform plan` should show an `azurerm_subscription_policy_assignment.monitor_vulnerability_assessment` resource being created (or updated) with the correct `policy_definition_id` and `subscription_id`, and no further changes on subsequent plans.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>