Azure Security Center and Qualys

[markus_pitkaranta]

In Ignite 2019 it was announced that ASC (standard tier) now provides vulnerability assessment solution for VMs (using Qualys) with no extra charge: "...we are announcing that the Azure Security Center Standard tier includes built-in vulnerability assessment for virtual machines for no additional fee" (https://techcommunity.microsoft.com/t5/Azure-Security-Center/Ignite-2019-releases-for-Azure-Security...)

I've tried to deploy the solution by:

1. Select the Vulnerability assessment solution should be installed on your virtual machines recommendation in ASC
2. Click Install after selecting the relevant VMs
3. However, going through the wizard it still asks of a Qualys license code and public key

So what does the "for no additional fee" actually mean? Do you still need some sort of a Qualys license to use this? Or I'm a doing something wrong in the deployment steps?

[#2]

Hello @markus_pitkaranta,

Do you have the standard tier enable for the Virtual Machines on which you want to enable the Qualys VM partner agent? According to Microsoft documentation, you need the standard tier.
https://docs.microsoft.com/en-us/azure/security-center/security-center-vulnerability-assessment-reco...

Kind Regards,

Thomas

[#3 · Accepted solution]

@markus_pitkaranta, the recommendation you've clicked ("Vulnerability assessment solution should be installed on your virtual machines") predates the Ignite announcement. It's the ASC recommendation to setup a vulnerability assessment solution on your VMs.

The Qualys powered extension announced at Ignite is deployed through a new recommendation as described in the new documentation page Integrated vulnerability scanner for virtual machines (Standard tier only).

Incidentally, the relevant recommendation "Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys)".

Note that the new recommendation is being rolled out gradually so it may not appear in your subscription yet.

I hope this helps.

[#4]

@melvynadam, thanks! That clarifies it. In my case, I can see the "new" recommendation in ASC but the status is "N/A". And when I open it, the "Remediate" button is greyed out. But maybe it's because it's being rolled out gradually, as you mentioned.

[#5]

@melvynadam, is there a schedule when the solution becomes available? We have enabled the standard tier and after 2 days still dont see the link in recommendations.  

[#6]

@melvynadam - We are also experiencing various issues with this new plugin. It seems to be working on a few of our instances, but we have several instances, where we have deployed extension, but it is not scanning.

Also - the results are not properly reflected in the Security Center.

We have security center standard tier for all our virtual machines. 

[#7]

@MV_BC, @LA1976, and @markus_pitkaranta,

The schedule isn't final yet but I'm expecting this new recommendation to be open to all customers in the very near future. I'll update this topic when it's done. Hopefully you'll notice the recommendation in Azure Security Center, before you get an alert from Tech Community :)

[#8]

@melvynadam- We actually have the options to install/remediate it, but it is just not really working for us. 

It is failing on installation of the extension or on collection of data. Currently it is only running properly on 1-2 VM's out of our entire population. 

[#9]

@MV_BC that wasn’t the reply I was hoping for!

Do you have an open ticket with support? If yes, send me the ticket number and we’ll track this from our side too.

[#10]

@melvynadam- We currently don't have an open ticket, but will raise one as soon as possible and try to get progress from there. 

[#11]

@melvynadam- I have raised a ticket with support. It has number 120020522000570. 

[#12]

@MV_BC, my understanding is that this ticket is now resolved. Do you need anything more from us?

[#13]

@melvynadam- Correct. It seems to be working on our end.