我有来自 Microsoft Defender for Cloud 的以下建议
应该在机器上启用文件完整性监控
我确实看过这篇文章 - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-enable-ama#enable-file-integrity-monitoring-with-ama 并且理解了
我想通过 Terraform 而不是手动启用它。我不知道从哪里开始。
【问题讨论】：
标签： azure azure-defender
我试图在我的环境中重现该场景：
代码：
resource "azurerm_windows_virtual_machine" "windows-vm" {
name = "kav-exp-machine"
resource_group_name = data.azurerm_resource_group.example.name
location =data.azurerm_resource_group.example.location
size = "Standard_F2"
admin_username = "adminuser"
admin_password = "xxxx"
network_interface_ids = [
azurerm_network_interface.example.id,
]
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter"
version = "latest"
}
}
resource "azurerm_virtual_machine_extension" "ama" {
#count = var.server_count
name = "kav-windows-vm-extension"
virtual_machine_id = azurerm_windows_virtual_machine.windows-vm.id
publisher = "Microsoft.Azure.Monitor"
type = "AzureMonitorWindowsAgent"
type_handler_version = "1.10"
auto_upgrade_minor_version = "true"
depends_on = [azurerm_windows_virtual_machine.windows-vm, azurerm_log_analytics_workspace.la_workspace]
lifecycle {
ignore_changes = [tags]
}
}
启用文件完整性管理的一些先决条件
代码：
resource "azurerm_subscription_policy_assignment" "asb_assignment" {
name = "azuresecuritybenchmark"
display_name = "Azure Security Benchmark"
policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8"
subscription_id = data.azurerm_subscription.current.id
}
resource "azurerm_security_center_subscription_pricing" "mdc_arm" {
tier = "Standard"
resource_type = "Arm"
}
resource "azurerm_security_center_subscription_pricing" "mdc_servers" {
tier = "Standard"
resource_type = "VirtualMachines"
}
resource "azurerm_security_center_setting" "setting_mcas" {
setting_name = "MCAS"
enabled = false
}
resource "azurerm_security_center_setting" "setting_mde" {
setting_name = "WDATP"
enabled = true
}
/*
resource "azurerm_security_center_contact" "mdc_contact" {
email = "xxxxx.com"
// phone = "xxxxx89"
alert_notifications = true
alerts_to_admins = true
}
*/
resource "azurerm_security_center_auto_provisioning" "auto-provisioning" {
auto_provision = "On"
}
resource "azurerm_security_center_workspace" "la_workspace" {
scope = data.azurerm_subscription.current.id
workspace_id = azurerm_log_analytics_workspace.la_workspace.id
}
resource "azurerm_subscription_policy_assignment" "va-auto-provisioning" {
name = "mdc-va-autoprovisioning"
display_name = "Configure machines to receive a vulnerability assessment provider"
policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/13ce0167-8ca6-4048-8e6b-f996402e3c1b"
subscription_id = data.azurerm_subscription.current.id
identity {
type = "SystemAssigned"
}
location = "West Europe"
parameters = <<PARAMS
{ "vaType": { "value": "mdeTvm" } }
PARAMS
}
resource "azurerm_role_assignment" "va-auto-provisioning-identity-role" {
scope = data.azurerm_subscription.current.id
role_definition_id = "/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd"
principal_id = azurerm_subscription_policy_assignment.va-auto-provisioning.identity[0].principal_id
}
resource "azurerm_security_center_automation" "la-exports" {
name = "ExportToWorkspace"
location =data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
action {
type = "loganalytics"
resource_id = azurerm_log_analytics_workspace.la_workspace.id
}
source {
event_source = "Alerts"
rule_set {
rule {
property_path = "Severity"
operator = "Equals"
expected_value = "High"
property_type = "String"
}
rule {
property_path = "Severity"
operator = "Equals"
expected_value = "Medium"
property_type = "String"
}
}
}
source {
event_source = "SecureScores"
}
source {
event_source = "SecureScoreControls"
}
scopes = [ data.azurerm_subscription.current.id ]
}
日志分析工作区和连接到日志分析工作区的 Microsoft 监控代理
代码：
resource "azurerm_log_analytics_workspace" "la_workspace" {
name = "kav-mdc-security-workspace"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
sku = "PerGB2018"
}
resource "azurerm_log_analytics_solution" "la_workspace_security" {
solution_name = "Security"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
workspace_resource_id = azurerm_log_analytics_workspace.la_workspace.id
workspace_name = azurerm_log_analytics_workspace.la_workspace.name
plan {
publisher = "Microsoft"
product = "OMSGallery/Security"
}
}
resource "azurerm_log_analytics_solution" "la_workspace_securityfree" {
solution_name = "SecurityCenterFree"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
workspace_resource_id = azurerm_log_analytics_workspace.la_workspace.id
workspace_name = azurerm_log_analytics_workspace.la_workspace.name
plan {
publisher = "Microsoft"
product = "OMSGallery/SecurityCenterFree"
}
}
如果 enable_change_tracking 设置为 true，则将更新工作区解决方案添加到日志分析。# 添加它可以启用更改跟踪和库存。
resource "azurerm_log_analytics_solution" "law_solution_change_tracking" {
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
solution_name = "ChangeTracking"
workspace_resource_id = azurerm_log_analytics_workspace.la_workspace.id
workspace_name = azurerm_log_analytics_workspace.la_workspace.name
plan {
publisher = "Microsoft"
product = "OMSGallery/ChangeTracking"
}
}
对于启用了 FIM 的解决方案类型的更改跟踪资源。如果更改跟踪资源被禁用，Defender for Cloud 中的文件完整性监控功能也会被禁用。
对于综合格斗：
resource "azurerm_virtual_machine_extension" "daa-agent" {
name = "DependencyAgentWindows"
virtual_machine_id = azurerm_windows_virtual_machine.windowsvm-c.id
publisher = "Microsoft.Azure.Monitoring.DependencyAgent"
type = "DependencyAgentWindows"
type_handler_version = "9.10"
automatic_upgrade_enabled = true
auto_upgrade_minor_version = true
}
resource "azurerm_virtual_machine_extension" "msmonitor-agent" {
depends_on = [ azurerm_virtual_machine_extension.daa-agent ]
name = "MicrosoftMonitoringAgent"
virtual_machine_id = azurerm_windows_virtual_machine.windowsvm-c.id
publisher = "Microsoft.EnterpriseCloud.Monitoring"
type = "MicrosoftMonitoringAgent"
type_handler_version = "1.0"
# Not yet supported
# automatic_upgrade_enabled = true
# auto_upgrade_minor_version = true
settings = <<SETTINGS
{
"workspaceId": "${azurerm_log_analytics_workspace.la_workspace.id}",
"azureResourceId": "${azurerm_windows_virtual_machine.windows-vm.id}",
"stopOnMultipleConnections": "false"
}
SETTINGS
protected_settings = <<PROTECTED_SETTINGS
{
"workspaceKey": "${azurerm_log_analytics_workspace.law.primary_shared_key}"
}
PROTECTED_SETTINGS
}
创建定义应监视的文件和注册表的数据收集规则。该修复将 DCR 附加到订阅中安装了 AMA 并启用了 FIM 的所有计算机。
resource "azurerm_monitor_data_collection_rule" "example" {
name = "kavya-data-coll-rules"
resource_group_name = data.azurerm_resource_group.example.name
location =data.azurerm_resource_group.example.location
destinations {
log_analytics {
workspace_resource_id = azurerm_log_analytics_workspace.la_workspace.id
name = "test-destination-log"
}
azure_monitor_metrics {
name = "test-destination-metrics"
}
}
data_flow {
streams = ["Microsoft-InsightsMetrics"]
destinations = ["test-destination-log"]
}
data_sources {
performance_counter {
streams = ["Microsoft-InsightsMetrics"]
sampling_frequency_in_seconds = 60
counter_specifiers = ["\VmInsights\DetailedMetrics"]
name = "VMInsightsPerfCounters"
}
}
}
# associate to a Data Collection Rule
resource "azurerm_monitor_data_collection_rule_association" "example1" {
name = "example1-dcra"
target_resource_id = azurerm_windows_virtual_machine.windows-vm.id
data_collection_rule_id = azurerm_monitor_data_collection_rule.example.id
description = "example"
}
根据地形规划
创建了以下资源：
然后我检查了文件完整性监控
为我的 Windows Defender 启用了文件完整性监控
有一个禁用选项可以在需要时禁用
参考：
【讨论】：