Configure Vulnerability Management for Azure

After you connect your Azure environment to Sysdig, you can configure Vulnerability Management (VM) Host Scanning. This feature performs vulnerability host scanning using disk Snapshots and Lighthouse to provide highly accurate views of vulnerability risk, access to public exploits, and risk management.

Sysdig released a new onboarding experience for Azure in August 2024. If you onboarded your Azure tenant and/or subscription before the 6th of August, 2024, and would like to add more features, contact your Sysdig representative.

Vulnerability Host Scanning relies on the following Azure features:

  • Azure LightHouse: Manages the relationship between the Sysdig Service Principal and the target subscriptions.
  • Snapshot: Shares disks with Sysdig.

To configure VM, set up volume access.

Prerequisites

Set Up Volume Access

Use the following instructions to set up volume access for Vulnerability Host Scanning for your Azure instances.

  1. Log in to Sysdig Secure, select Integrations > Cloud Accounts > Azure.
  2. Select an account that is part of the tenant you would like to add features to or the individual account you onboarded. On the right panel, you will see a list of features.
  3. Click Setup beside a desired feature to open the wizard.
  4. Ensure you have the necessary permissions configured as described in the initial setup.
  5. Exclude or Include Resources from Vulnerability Scanning:
  6. Verify the details of your tenant and the subscription where the features will be added.
  7. Generate and apply the Terraform code:
    1. Create a volume_access.tf file in the folder that contains your main.tf.
    2. Copy the snippet provided into the volume_access.tf file.
    3. Run the command: terraform init && terraform apply.

Exclude/Include Resources from Vulnerability Scanning

By default, all Resource Groups and Virtual Machines with root disks are included in scans. To manage exclusions and inclusions, use the following tags:

KeyValueDescription
sysdig:secure:scantrueInclude in scan
falseExclude from scan
sysdig:secure:data-volumes:scantrueInclude data volumes in scan
falseExclude data volumes from scan

Usage Examples

TagLevelEffect
sysdig:secure:scan: "false"Resource GroupExcludes all resources within that group from scanning
sysdig:secure:scan: "false"Virtual MachineExcludes the VM and all its disks from scanning
sysdig:secure:scan: "true"Data DiskIncludes the disk for scanning
sysdig:secure:data-volumes:scan: "true"Resource GroupIncludes all data disks in that group for scanning
sysdig:secure:data-volumes:scan: "true"Virtual MachineIncludes all its data disks for scanning
sysdig:secure:data-volumes:scan: "true"Resource Group and VMExcludes the VM’s data-disks but includes others in the group

Redundant Tags

TagDescription
sysdig:secure:scan: "true"Sysdig scans by default, so these tags are redundant.
sysdig:secure:data-volumes:scan: "false"Sysdig does not scan data volumes by default unless explicitly included.

Validate

You can verify your Vulnerability Management configuration by checking your connection status:

  1. Log in to Sysdig Secure and select Integrations > Cloud Accounts > Azure.
  2. Select your account. The Detail panel appears on the right.

You will see the feature as Connected. This may take up to 5 minutes after deploying the Terraform.