Cis Azure Compute 20.7
DevOps & Securitycis-azure-compute-20.7Cis Azure Compute 20.7 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Ensure that Endpoint Protection for all Virtual Machines is installed
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-20.7/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-azure-compute-20-7, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Ensure that Endpoint Protection for all Virtual Machines is installed
Description
Install endpoint protection for all virtual machines.
Rationale
Installing endpoint protection systems (like anti-malware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These also offer configurable alerts when known-malicious or unwanted software attempts to install itself or run on Azure systems.
Impact
Endpoint protection will incur an additional cost to you.
Audit Procedure
Using Azure Portal
- Go to
Security Center - Click the
Recommendationsblade - Ensure that there are no recommendations for
Endpoint Protection not installed on Azure VMs
Using Azure CLI
az vm show -g <MyResourceGroup> -n <MyVm> -d --query "resources[?type=='Microsoft.Compute/virtualMachines/extensions'].{ExtensionName:name}" -o table
If extensions are installed, it will list the installed extensions.
Look for extensions such as:
EndpointSecurity || TrendMicroDSA* || Antimalware || EndpointProtection || SCWPAgent || PortalProtectExtension* || FileSecurity*
Alternatively, you can employ your own endpoint protection tool for your OS.
Expected Result
All virtual machines should have at least one endpoint protection extension installed, or an equivalent endpoint protection tool deployed.
Remediation
Using Azure Portal
Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your own endpoint protection tool for your OS.
Default Value
By default Endpoint Protection is disabled.
References
- https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection
- https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware
- https://docs.microsoft.com/en-us/cli/azure/vm/extension?view=azure-cli-latest#az_vm_extension_list
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-endpoint-security#es-1-use-endpoint-detection-and-response-edr
Profile
Level 2 | Manual