Virtual Machine must have endpoint protection installed
High
Azure
General
vm-virtual-machine-endpoint-protection
Applies to
Microsoft.Compute/virtualMachines
What CGPulse checks
A resource passes this rule when resources[?(@.type=='Microsoft.Compute/virtualMachines/extensions' && @.properties.type=='IaaSAntimalware')] must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.
How to fix it
Install anti-malware protection to defend against viruses and ransomware. In Azure Portal: VM > Extensions > Add > select Microsoft Antimalware. See: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/iaas-antimalware-windows
Terraform
# Deploy antimalware extension via azurerm_virtual_machine_extension
# or use Azure Policy for automatic deployment.
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Azure rules
- Action Group should be enabled
- Activity Log Alert should be enabled
- AKS cluster logs should be sent to Log Analytics
- AKS cluster must enable RBAC
- AKS cluster must enable RBAC
- AKS cluster should be a private cluster
- AKS cluster should disable local accounts
- AKS cluster should enable Azure RBAC for Kubernetes