lacework-global-637
7.5 Install Endpoint Protection for all Virtual Machines (Manual)
Profile Applicability
• Level 2
Description
Install endpoint protection for all virtual machines.
Rationale
Installing endpoint protection systems (like anti-malware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These also offer configurable alerts when known-malicious or unwanted software attempts to install itself or run on Azure systems.
Impact
Endpoint protection will incur an additional cost to you.
Audit
From Azure Portal
- Go to
Security Center - Click the
Recommendationsblade - Ensure that there are no recommendations for
Endpoint Protection not installed on Azure VMs
From Azure CLI
az vm show -g MyResourceGroup -n MyVm -d
It should list below or any other endpoint extensions as one of the installed extensions.
EndpointSecurity || TrendMicroDSA* || Antimalware || EndpointProtection || SCWPAgent || PortalProtectExtension* || FileSecurity*
Alternatively, you can employ your own endpoint protection tool for your OS.
Remediation
Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your own endpoint protection tool for your OS.
References
https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection
https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware
https://docs.microsoft.com/en-us/cli/azure/vm/extension?view=azure-cli-latest#az_vm_extension_list
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-endpoint-security#es-1-use-endpoint-detection-and-response-edr