Skip to main content

📝 Azure Virtual Machine Endpoint Protection is not installed 🟢

  • Contextual name: 📝 Endpoint Protection is not installed 🟢
  • ID: /ce/ca/azure/virtual-machine/endpoint-protection
  • Located in: 📁 Azure Virtual Machines

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Description​

Open File

Description​

Install endpoint protection for all virtual machines.

Rationale​

Installing endpoint protection systems (like anti-malware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These also offer configurable alerts when known-malicious or unwanted software attempts to install itself or run on Azure systems.

Impact​

Endpoint protection will incur an additional cost to you.

Audit​

From Azure Portal​
  1. Go to Security Center.
  2. Click the Recommendations blade.
  3. Ensure that there are no recommendations for Endpoint Protection not installed on Azure VMs.
From Azure CLI​
az vm show -g <MyResourceGroup> -n <MyVm> -d --query "resources[?type=='Microsoft.Compute/virtualMachines/extensions'].{ExtensionName:name}" -o table

If extensions are installed, it will list the installed extensions:

EndpointSecurity || TrendMicroDSA* || Antimalware || EndpointProtection || SCWPAgent || PortalProtectExtension* || FileSecurity*

... [see more](description.md)

Remediation​

Open File

Remediation​

Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your own endpoint protection tool for your OS.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS Azure v2.1.0 → 💼 7.6 Ensure that Endpoint Protection for all Virtual Machines is installed - Level 2 (Manual)1
💼 CIS Azure v3.0.0 → 💼 8.8 Ensure that Endpoint Protection for all Virtual Machines is installed (Manual)1
💼 Cloudaware Framework → 💼 Threat Protection25