Enable Monitoring for OS Vulnerabilities

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features

Knowledge Base Microsoft Azure Security Center Enable Monitoring for OS Vulnerabilities

Risk level: Medium (should be achieved)

Rule ID: SecurityCenter-004

Ensure that monitoring for operating system (OS) vulnerabilities is enabled within Microsoft Azure Security Center in order to determine if your Azure virtual machines are vulnerable to attacks. Azure Security Center analyzes daily the operating system of your virtual machines for configurations that could make these VMs more vulnerable to cyber attacks. The Security Center service also recommends specific configuration changes that you can apply in order to address any found OS vulnerabilities.

This rule resolution is part of the Cloud Conformity Security & Compliance tool for Azure

Security

When Monitor OS Vulnerabilities feature is enabled, Azure Security Center analyzes operating system configurations on a daily basis to identify security issues that could make your organization's systems vulnerable to attacks.

Audit

To determine if "Monitor OS Vulnerabilities" feature is enabled, perform the following actions:

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the navigation panel, choose Security policy to access Policy Management portal.

04 On the Policy Management page, click on the name of the subscription that you want to examine to access the selected subscription configuration settings.

05 On the Security Policy page, in the Compute and Apps category, check the Vulnerabilities in security configuration on your machines should be remediated setting status. If the configuration setting is set to Disabled, the OS vulnerability monitoring is not enabled for the Microsoft Azure virtual machines (VMs) available in the current subscription.

06 Repeat step no. 4 and 5 for each Microsoft Azure subscription available in your account.

Using Azure CLI and PowerShell

01 Run account get-access-token command (Windows/macOS/Linux) using custom query filters to get the "Monitor OS Vulnerabilities" feature status for the current Azure account subscription:

az account get-access-token
	--query "{subscription:subscription,accessToken:accessToken}"
	--out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn?api-version=2018-05-01' | jq 'select(.name=="SecurityCenterBuiltIn")'|jq '.properties.parameters.systemConfigurationsMonitoringEffect.value'

02 The command output should return the requested feature configuration status:

"Disabled"

If the command output returns "Disabled", as shown in the example above, the operating system (OS) vulnerability monitoring is not enabled for the Azure virtual machines (VMs) provisioned for the selected subscription.

03 Repeat step no. 1 and 2 for each Microsoft Azure subscription available in your account.

Remediation / Resolution

To enable OS vulnerability monitoring and recommendations for your Microsoft Azure virtual machines (VMs), perform the following actions:

Using Azure Console

01 Sign in to Azure Management Console.

02 Navigate to Azure Security Center blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/.

03 In the navigation panel, choose Security policy to access Policy Management portal.

04 On the Policy Management page, click on the name of the subscription that you want to reconfigure to access the subscription configuration settings.

05 On the Security Policy page, click on the ASC Default (subscription: abcdabcd-1234-1234-1234-abcdabcdabcd) policy assignment to edit the policy configuration.

06 On the selected policy assignment page, in the PARAMETERS section, select AuditIfNotExists from Monitor OS Vulnerabilities dropdown list to enable operating system (OS) vulnerability monitoring for all the Microsoft Azure virtual machines (VMs) available in the selected Azure subscription.

07 Click Save to apply the changes. If the request is successful, the following message should be displayed: "Updating policy assignment succeeded". Once the configuration changes are saved, the OS vulnerability monitoring feature becomes active for the selected Azure subscription.

08 If required, repeat steps no. 4 – 7 for other Microsoft Azure cloud subscription available.

Using Azure CLI and PowerShell

01 Define the necessary parameters for the account get-access-token command, where the systemUpdatesMonitoringEffect configuration parameter is enabled. Save the following content to a JSON file named enable-system-configurations-monitoring.json and replace the highlighted details, i.e. <azure-subscription-id> and <policy-definition-id>, with your own Azure account details:

{
   "properties":{
      "displayName":"ASC Default (subscription: <azure-subscription-id>)",
      "policyDefinitionId":"/providers/Microsoft.Authorization/policySetDefinitions/<policy-definition-id>",
      "scope":"/subscriptions/<azure-subscription-id>",
      "parameters":{
         "systemConfigurationsMonitoringEffect":{
            "value":"AuditIfNotExists"
         }
      }
   },
   "id":"/subscriptions/<azure-subscription-id>/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn",
   "type":"Microsoft.Authorization/policyAssignments",
   "name":"SecurityCenterBuiltIn",
   "location":"eastus"
}

02 Run account get-access-token command (Windows/macOS/Linux) using the parameters defined at the previous step (i.e. enable-system-configurations-monitoring.json file) to enable the Security Center OS vulnerability monitoring for the selected Microsoft Azure cloud subscription (the command request does not produce an output):

az account get-access-token
	--query "{subscription:subscription,accessToken:accessToken}"
	--out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn?api-version=2018-05-01 -d@"enable-system-configurations-monitoring.json"'

03 If successful, the command output should return the updated Azure Security Center policy (truncated):

{
   "sku":{
      "name":"A0",
      "tier":"Free"
   },
   "properties":{
      "displayName":"ASC Default (subscription: abcdabcd-1234-1234-1234-abcdabcdabcd)",
      "scope":"/subscriptions/abcdabcd-1234-1234-1234-abcdabcdabcd",

      ...

      "description":"This is the default set of policies monitored by Azure Security Center. It was automatically assigned as part of on-boarding to Security Center. The default assignment contains only audit policies. For more information please visit https://aka.ms/ascpolicies",
   },
   "id":"/subscriptions/abcdabcd-1234-1234-1234-abcdabcdabcd/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn",
   "type":"Microsoft.Authorization/policyAssignments",
   "name":"SecurityCenterBuiltIn",
   "location":"eastus"
}

04 If required, repeat steps no. 1 – 3 for other Microsoft Azure cloud subscription available.

References

Azure Official Documentation
Working with security policies
Protecting your machines and applications in Azure Security Center
CIS Microsoft Azure Foundations

Azure Command Line Interface (CLI) Documentation
az
az account get-access-token

Publication date May 21, 2019

Enable Monitoring for OS Vulnerabilities

Audit

Using Azure Console

Using Azure CLI and PowerShell

Remediation / Resolution

Using Azure Console

Using Azure CLI and PowerShell

References

Related SecurityCenter rules