Skip to main content

lacework-global-637

7.5 Ensure that Endpoint Protection for all Virtual Machines is installed (Manual)​

Profile Applicability​

• Level 2

Description​

Install endpoint protection for all virtual machines.

Rationale​

Installing endpoint protection systems (like anti-malware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These also offer configurable alerts when known-malicious or unwanted software attempts to install itself or run on Azure systems.

Impact​

Endpoint protection will incur an additional cost to you.

Audit​

From Azure Portal​

  1. Go to Security Center
  2. Click the Recommendations blade
  3. Ensure that there are no recommendations for Endpoint Protection not installed on Azure VMs

From Azure CLI​

az vm show -g MyResourceGroup -n MyVm -d

It should list below or any other endpoint extensions as one of the installed extensions.

EndpointSecurity || TrendMicroDSA* || Antimalware || EndpointProtection || SCWPAgent || PortalProtectExtension* || FileSecurity*

Alternatively, you can employ your own endpoint protection tool for your OS.

Remediation​

Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your own endpoint protection tool for your OS.

References​

https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection
https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware
https://docs.microsoft.com/en-us/cli/azure/vm/extension?view=azure-cli-latest#az_vm_extension_list
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-endpoint-security#es-1-use-endpoint-detection-and-response-edr