Virtual Machine should have monitoring agent installed

Medium Azure General vm-virtual-machine-monitoring-agent

Azure Monitor Agent collects monitoring data and delivers it to Azure Monitor for analysis

Applies to

Microsoft.Compute/virtualMachines

What CGPulse checks

A resource passes this rule when extensions.hasMonitoringAgent must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Install Azure Monitor Agent to send logs and metrics for security monitoring. In Azure Portal: VM > Extensions > Add > select Azure Monitor Agent. See: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview

CLI

az vm extension set -g "{rg}" --vm-name "{name}" --name AzureMonitorWindowsAgent --publisher Microsoft.Azure.Monitor --version "1.*"

Terraform

resource "azurerm_virtual_machine_extension" "monitoring" {
  name                       = "AzureMonitorAgent"
  virtual_machine_id         = "{id}"
  publisher                  = "Microsoft.Azure.Monitor"
  type                       = "AzureMonitorLinuxAgent"
  type_handler_version       = "1.0"
  auto_upgrade_minor_version = true
  # For Windows VMs, change type to "AzureMonitorWindowsAgent"
  # Also create a Data Collection Rule and associate it
}

Compliance frameworks

Cloud Security BaselineES-3

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan