Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Defender for Servers plan in Microsoft Defender for Cloud provides vulnerability scanning for protected machines.
Integrated vulnerability scanning in Defender for Cloud uses Microsoft Defender Vulnerability Management and provides both agentless and agent-based scanning.
Vulnerability management is enabled by default when you enable Defender for Servers. Use this article only if you need to enable scanning manually.
Prerequisites
| Requirement | Details |
|---|---|
| Agentless vulnerability scanning | Review agentless scanning requirements. Agentless scanning is on by default when Defender for Servers Plan 2 or the Defender for Servers Cloud Security Posture Management (CSPM) plan is enabled. |
| Agent-based vulnerability scanning | For agent-based scanning, enable Defender for Servers Plan 1 (P1) or Plan 2 (P2). |
| Machine support | Review supported machines. |
| Permissions | You need Owner (resource group level) permissions to deploy the scanner. You need Security Reader to view findings. |
Enable vulnerability scanning on a subscription
In Defender for Cloud, open Environment settings.
Select the relevant subscription.
Locate Defender for Servers plan, select Monitoring coverage > Settings.
In Settings and monitoring, turn on Vulnerability assessment for machines as needed.
Select Edit configuration to choose an assessment solution.
Select Apply > Save.
Configure with the REST API
To configure with the REST API, run PUT/DELETE using this URL:
https://management.azure.com/subscriptions/.../resourceGroups/.../providers/Microsoft.Compute/virtualMachines/.../providers/Microsoft.Security/serverVulnerabilityAssessments/mdetvm?api-version=2015-06-01-preview
Enable vulnerability scanning for a machine
To enable vulnerability scanning for a specific machine, use the recommendation that appears when Defender for Servers doesn't find a vulnerability assessment solution on the machine.
To find all machines without a solution installed, in the Inventory page, select Unhealthy resources. Use the Recommendations filter to search for machines with this recommendation:
Machines should have a vulnerability assessment solution.Open the recommendation.
Follow the remediation steps to fix machines that don't have a vulnerability assessment solution enabled.
Select a vulnerability solution.
After the process completes, it can take up to 24 hours for resources to move to the Healthy resources tab.