VM Endpoint Bescherming

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS VM Endpoint Protection Installed .DESCRIPTION CIS Azure Foundations Benchmark - Control 7.5 Controleert of endpoint protection is geïnstalleerd op VMs. .NOTES Filename: vm-endpoint-protection-installed.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 CIS Control: 7.5 #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.Compute [CmdletBinding()] param([Parameter()][switch]$Monitoring) $ErrorActionPreference = 'Stop' $PolicyName = "VM Endpoint Protection Installed" function Connect-RequiredServices { if (-not (Get-AzContext)) { Connect-AzAccount | Out-Null } } function Test-Compliance { $vms = Get-AzVM -ErrorAction SilentlyContinue $result = @{ TotalVMs = $vms.Count; WithEndpointProtection = 0 } foreach ($vm in $vms) { $extensions = Get-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -ErrorAction SilentlyContinue $hasEP = $extensions | Where-Object { $_.Publisher -like "*Endpoint*" -or $_.Publisher -like "*Antimalware*" -or $_.ExtensionType -like "*Antimalware*" -or $_.Publisher -eq "Microsoft.Azure.Security.Monitoring" -or $_.Publisher -eq "Microsoft.EnterpriseCloud.Monitoring" } if ($hasEP) { $result.WithEndpointProtection++ } } return $result } try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Endpoint Protection: $($r.WithEndpointProtection)" -ForegroundColor $(if ($r.WithEndpointProtection -eq $r.TotalVMs) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nEndpoint Protection: $($r.WithEndpointProtection)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } # ================================================================================ # Standaard Invoke-* Functions (Auto-generated) # ================================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() $Monitoring = $true try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Endpoint Protection: $($r.WithEndpointProtection)" -ForegroundColor $(if ($r.WithEndpointProtection -eq $r.TotalVMs) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nEndpoint Protection: $($r.WithEndpointProtection)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }