Overview
Install endpoint protection for all virtual machines.
Rationale
Installing endpoint protection systems (like anti-malware for Azure) provides real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These systems also offer configurable alerts when known malicious or unwanted software attempts to install itself or run on Azure systems.
Impact
Endpoint protection will incur additional costs.
Default Value
By default, no endpoint protection is installed.
Remediation guidance
Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your endpoint protection tool for your OS.
References
Azure Portal (Asset-Level)
- Open the affected resource from the finding details in Azure Portal.
- Navigate to the relevant Security/Configuration/Networking blade.
- Apply the control-specific secure setting.
- Save and re-run the check.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Platform
Use the provider or platform baseline, preventive policy, and IaC modules to enforce this setting consistently when many resources are affected.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
No stored query bodies are attached to this entry.
