Control: Auto provisioning of the Log Analytics agent should be enabled on your subscription

Description

To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.

Usage

Run the control in your terminal:

powerpipe control run terraform_azure_compliance.control.securitycenter_automatic_provisioning_monitoring_agent_on

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run terraform_azure_compliance.control.securitycenter_automatic_provisioning_monitoring_agent_on --share

SQL

This control uses a named query:

select
  address as resource,
  case
    when (attributes_std ->> 'auto_provision') = 'On' then 'ok'
    else 'alarm'
  end status,
  split_part(address, '.', 2) || case
    when (attributes_std ->> 'auto_provision') = 'On' then ' automatic provisioning of monitoring agent is on'
    else ' automatic provisioning of monitoring agent is off'
  end || '.' reason
  , path || ':' || start_line
from
  terraform_resource
where
  type = 'azurerm_security_center_auto_provisioning';

Control: Auto provisioning of the Log Analytics agent should be enabled on your subscription

Description

Usage

SQL

Tags