Edit

Remediate machine vulnerabilities

The Defender for Servers plan in Microsoft Defender for Cloud scans protected machines for vulnerabilities. It supports both agentless and agent-based scanning through Microsoft Defender Vulnerability Management.

Requirement Details
Plan For agentless scanning, enable Defender for Servers Plan 2 and turn on agentless scanning in the plan.

For agent-based scanning, enable Defender for Servers Plan 1 or Plan 2 and turn on Defender for Endpoint integration.
Agentless scanning Review the prerequisites for agentless scanning.
Agent-based scanning Review the prerequisites for Defender for Endpoint integration in Defender for Servers.

View scan findings

To view and fix vulnerability findings from your configured scanners:

  1. From Defender for Cloud's menu, open the Recommendations page.

  2. Select the recommendation Machines should have vulnerability findings resolved.

    Defender for Cloud shows findings for all VMs in the selected subscriptions. Findings are ordered by severity.

    The findings from your vulnerability assessment solutions for all selected subscriptions.

  3. To filter findings by a single VM, open the Affected resources section and select the VM. Or, select a VM from the resource health view to see all recommendations for that resource.

    Defender for Cloud shows the findings for that VM, ordered by severity.

  4. To learn more about a specific vulnerability, select it.

    Details pane for a specific vulnerability.

    The details pane includes the following vulnerability information:

    • Links to all relevant CVEs (where available)
    • Remediation steps
    • Any more reference pages
  5. To remediate a finding, follow the remediation steps from the details pane.

Export the results

You can export vulnerability assessment results with Azure Resource Graph. Resource Graph lets you quickly access resource data across cloud environments. Filter, group, and sort results across Azure subscriptions in the portal or by using code.

For full instructions and a sample ARG query, see the following Tech Community post: Exporting vulnerability assessment results in Microsoft Defender for Cloud.

Next steps