Configure Vulnerability Management for Azure

Vulnerability Host Scanning relies on the following Azure features:

• Azure LightHouse: Manages the relationship between the Sysdig Service Principal and the target subscriptions.
• Snapshot: Shares disks with Sysdig.

To configure VM, set up volume access.

Prerequisites

• You must have an Azure Subscription or Tenant already connected to Sysdig.

• Access to a User with the permissions required to install.

• Enable Microsoft Managed Services (Lighthouse) in each subscription using agentless scanning:

  for sub in $(az account list --query "[].id" -o tsv); do
  echo "Registering MMS in $sub"
  az provider register --namespace Microsoft.ManagedServices --subscription "$sub"
  done
  

  For more details, see Missing Microsoft.ManagedServices Namespace Registration.

Set Up Volume Access

Use the following instructions to set up volume access for Vulnerability Host Scanning for your Azure instances.

1. Log in to Sysdig Secure, select Integrations > Cloud Accounts > Azure.
2. Select an account that is part of the tenant you would like to add features to or the individual account you onboarded. On the right panel, you will see a list of features.
3. Click Setup beside a desired feature to open the wizard.
4. Ensure you have the necessary permissions configured as described in the initial setup.
5. Exclude or Include Resources from Vulnerability Scanning:
   • You can exclude resource groups and virtual machines from scans using tags.
   • For more information, see how to include/exclude resources.
6. Verify the details of your tenant and the subscription where the features will be added.
7. Generate and apply the Terraform code:
   1. Create a volume_access.tf file in the folder that contains your main.tf.
   2. Copy the snippet provided into the volume_access.tf file.
   3. Run the command: terraform init && terraform apply.

Exclude/Include Resources from Vulnerability Scanning

By default, all Resource Groups and Virtual Machines with root disks are included in scans. To manage exclusions and inclusions, use the following tags:

Usage Examples

Redundant Tags

Check the Connection Status

You can verify your Vulnerability Management configuration by checking your connection status:

1. Log in to Sysdig Secure and select Integrations > Cloud Accounts > Azure.

2. Select your account.

   The detail drawer appears on the right.

   If the connection is successful, you will see the feature as Connected. This may take up to 5 minutes after deploying the Terraform.

Given below are the possible health statuses for Vulnerability Management Host Scanning and Workload Scanning:

Host Scanning

Health status of Host scanning is checked every 8 hours.

Workload Scanning

Health status of Workload scanning is checked every 3 hours.