arc enabled vm qualys vuln ext install

This policy deploys the Qualys vulnerability assessment extension to Windows and Linux ARC enabled virtual machines.
Azure · Aug 6, 2021 · f13d7ff · f13d7ff
1 parent bc62efe
commit f13d7ff
Show file tree

Hide file tree

Showing 2 changed files with 106 additions and 0 deletions.
diff --git a/...ent solution on ARC virtual machines (powered by Qualys)/Azure Policy/README.MD b/...ent solution on ARC virtual machines (powered by Qualys)/Azure Policy/README.MD
@@ -0,0 +1,25 @@
+# Deploy Qualys vulnerability assessment solution on ARC enabled virtual machines
+Author: Nathan Swift
+
+This policy deploys Azure Security Center built-in vulnerability assessment solution (Powered by Qualys) on ARC enabled virtual machines.
+
+## Try on Portal
+
+[![Deploy to Azure](https://docs.microsoft.com/en-us/azure/governance/policy/media/deploy/deploybutton.png)](https://portal.azure.com/?#blade/Microsoft_Azure_Policy/CreatePolicyDefinitionBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Security-Center%2Fmaster%2FRemediation%2520scripts%2FEnable%2520the%2520built-in%2520vulnerability%2520assessment%2520solution%2520on%2520ARC%2520virtual%2520machines%2520%28powered%2520by%2520Qualys%29%2FAzure%2520Policy%2Fdeploy-qualys-va.json)
+
+### Please note
+The built-in vulnerability assessment solution powered by Qualys is available on Azure Security Center standard tier only.
+
+# Contributing
+
+This project welcomes contributions and suggestions.  Most contributions require you to agree to a
+Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
+the rights to use your contribution. For details, visit https://cla.microsoft.com.
+
+When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
+a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
+provided by the bot. You will only need to do this once across all repos using our CLA.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
+contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. 
diff --git a/...t solution on ARC virtual machines (powered by Qualys)/Azure Policy/deploy-qualys-va.json b/...t solution on ARC virtual machines (powered by Qualys)/Azure Policy/deploy-qualys-va.json
@@ -0,0 +1,81 @@
+{
+  "properties": {
+    "displayName": "Deploy Qualys vulnerability assessment solution on ARC enabled virtual machines",
+    "policyType": "Custom",
+    "mode": "All",
+    "description": "This policy deploys the Qualys vulnerability assessment extension to Windows and Linux ARC enabled virtual machines.",
+    "metadata": {
+      "version": "1.0.0",
+      "category": "Security Center"
+    },
+    "parameters": {},
+    "policyRule": {
+      "if": {
+        "field": "type",
+        "in": [
+          "Microsoft.HybridCompute/machines"
+        ]
+      },
+      "then": {
+        "effect": "deployIfNotExists",
+        "details": {
+          "type": "Microsoft.HybridCompute/machines/extensions",
+          "roleDefinitionIds": [
+            "/providers/microsoft.authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
+          ],
+          "existenceCondition": {
+            "allOf": [
+              {
+                "field": "Microsoft.HybridCompute/machines/extensions/type",
+                "in": [
+                    "WindowsAgent.AzureSecurityCenter",
+                    "LinuxAgent.AzureSecurityCenter"
+                ]
+              },
+              {
+                "field": "Microsoft.HybridCompute/machines/extensions/publisher",
+                "equals": "Qualys"
+              },
+              {
+                "field": "Microsoft.HybridCompute/machines/extensions/provisioningState",
+                "equals": "Succeeded"
+              }
+            ]
+          },
+          "deployment": {
+            "properties": {
+              "mode": "Incremental",
+              "template": {
+                "contentVersion": "1.0.0.0",
+                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
+                "parameters": {
+                  "vmName": {
+                    "type": "string"
+                  },
+                  "apiVersionByEnv": {
+                    "type": "string"
+                  }
+                },
+                "resources": [
+                  {
+                    "type": "Microsoft.HybridCompute/machines/providers/serverVulnerabilityAssessments",
+                    "name": "[concat(parameters('vmName'), '/Microsoft.Security/default')]",
+                    "apiVersion": "[parameters('apiVersionByEnv')]"
+                  }
+                ]
+              },
+              "parameters": {
+                "vmName": {
+                  "value": "[field('name')]"
+                },
+                "apiVersionByEnv": {
+                  "value": "2020-01-01"
+                }
+            }
+          }
+        }
+        }
+      }
+    }
+  }
+}