Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On

Using Console

To remediate the misconfiguration “Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On” for AZURE using AZURE console, follow the below steps:

Login to the Azure portal using your credentials.
Navigate to the Security Center dashboard from the left-hand side menu.
Click on the “Security policy” tab from the top menu.
Select the subscription and the scope for which you want to configure the vulnerability assessment settings.
Click on the “Edit” button to edit the security policy.
Scroll down to the “Vulnerability Assessment” section and click on the “On” button for “Periodic recurring scans”.
Set the “Recurring scans” frequency as per your requirement.
Click on the “Save” button to save the changes.

Once the above steps are completed, the vulnerability assessment setting for periodic recurring scans will be turned on and the system will perform periodic scans as per the configured frequency.

Using CLI

To remediate the misconfiguration “Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On” for Azure using Azure CLI, you can follow the below steps:

Open the Azure CLI command prompt.
Run the following command to enable vulnerability assessment for the specified Azure SQL Server:
az sql server va show --resource-group <resource-group-name> --server <server-name> --name default
This command will show the current status of vulnerability assessment for the specified Azure SQL Server.
Run the following command to enable periodic recurring scans for the specified Azure SQL Server:
az sql server va update --resource-group <resource-group-name> --server <server-name> --name default --email-admins On --email-address <email-address> --state On --recurring-scans-interval 1
This command will enable periodic recurring scans for the specified Azure SQL Server with a frequency of 1 day.
Verify the vulnerability assessment settings by running the following command:
az sql server va show --resource-group <resource-group-name> --server <server-name> --name default
This command will show the updated status of vulnerability assessment for the specified Azure SQL Server.

By following these steps, you can remediate the misconfiguration “Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On” for Azure using Azure CLI.

Using Python

To remediate the misconfiguration “Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On” in Azure using Python, you can use the Azure SDK for Python. Here are the steps to remediate the issue:

Install the Azure SDK for Python using the following command:

pip install azure-mgmt-security

Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.security import SecurityCenter

Set up the credentials and the client:

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
CLIENT_SECRET = '<your client secret>'
SUBSCRIPTION_ID = '<your subscription id>'

credentials = ServicePrincipalCredentials(
    client_id=CLIENT_ID,
    secret=CLIENT_SECRET,
    tenant=TENANT_ID
)

security_center_client = SecurityCenter(credentials, SUBSCRIPTION_ID)

Get the security policy for your subscription:

policy = security_center_client.policies.get('default')

Update the vulnerability assessment setting to enable periodic recurring scans:

vulnerability_assessment_settings = policy.security_contact_configurations.vulnerability_assessment
vulnerability_assessment_settings.recurring_scans = True

security_center_client.policies.create_or_update(policy.id, policy)

This will enable the vulnerability assessment setting for periodic recurring scans in Azure.

Using Terraform

resource "azurerm_mssql_server" "SQL_SERVER" {
  name                         = "SQL_SERVER_NAME"
  resource_group_name          = "RESOURCE_GROUP_NAME"
  location                     = "AZURE_REGION"
  version                      = "12.0"
  administrator_login          = "SQL_ADMIN_LOGIN"
  administrator_login_password = "SQL_ADMIN_PASSWORD"
}

resource "azurerm_storage_account" "VA_STORAGE" {
  name                     = "VA_STORAGE_ACCOUNT_NAME"
  resource_group_name      = azurerm_mssql_server.SQL_SERVER.resource_group_name
  location                 = azurerm_mssql_server.SQL_SERVER.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_storage_container" "VA_CONTAINER" {
  name                  = "VA-SCAN-RESULTS-CONTAINER" # e.g. "vulnerability-assessment"
  storage_account_name  = azurerm_storage_account.VA_STORAGE.name
  container_access_type = "private"
}

data "azurerm_storage_account_sas" "VA_SAS" {
  connection_string = azurerm_storage_account.VA_STORAGE.primary_connection_string
  https_only        = true
  start             = "2025-01-01"
  expiry            = "2030-01-01"

  resource_types {
    service   = true
    container = true
    object    = true
  }

  services {
    blob  = true
    queue = false
    table = false
    file  = false
  }

  permissions {
    read    = true
    write   = true
    delete  = true
    list    = true
    add     = true
    create  = true
    update  = true
    process = false
  }
}

resource "azurerm_mssql_server_vulnerability_assessment" "SQL_SERVER_VA" {
  server_security_alert_policy_id = azurerm_mssql_server.SQL_SERVER.id

  storage_container_path = "${azurerm_storage_account.VA_STORAGE.primary_blob_endpoint}${azurerm_storage_container.VA_CONTAINER.name}"
  storage_account_access_key = azurerm_storage_account.VA_STORAGE.primary_access_key

  recurring_scans {
    enabled                   = true
    email_subscription_admins = true
    emails                    = ["SECURITY_TEAM_EMAIL@example.com"]
  }
}

Substitute:

SQL_SERVER_NAME with your Azure SQL logical server name.
RESOURCE_GROUP_NAME with the server’s resource group.
AZURE_REGION with the region of the server, e.g. "eastus".
SQL_ADMIN_LOGIN / SQL_ADMIN_PASSWORD with your admin credentials.
VA_STORAGE_ACCOUNT_NAME with a globally-unique storage account name.
SECURITY_TEAM_EMAIL@example.com with one or more security notification emails.

This change does not force replacement of the SQL server; it adds/updates the server vulnerability assessment configuration to enable periodic recurring scans.After applying, terraform plan should show creation or update of azurerm_mssql_server_vulnerability_assessment.SQL_SERVER_VA with recurring_scans.enabled set to true.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Ensure That Vulnerability Assessment Setting Periodic Recurring Scans Is Set To On

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: