VM Kwetsbaarheidsbeoordeling

<# ================================================================================ AZURE POWERSHELL SCRIPT - Nederlandse Baseline voor Veilige Cloud ================================================================================ .SYNOPSIS VM Vulnerability Assessment Enabled .DESCRIPTION CIS Azure Foundations Benchmark - Control 7.13 Controleert of vulnerability assessment is ingeschakeld op VMs. .NOTES Filename: vm-vulnerability-assessment-enabled.ps1 Author: Nederlandse Baseline voor Veilige Cloud Version: 1.0 CIS Control: 7.13 #> #Requires -Version 5.1 #Requires -Modules Az.Accounts, Az.Compute [CmdletBinding()] param([Parameter()][switch]$Monitoring) $ErrorActionPreference = 'Stop' $PolicyName = "VM Vulnerability Assessment Enabled" function Connect-RequiredServices { if (-not (Get-AzContext)) { Connect-AzAccount | Out-Null } } function Test-Compliance { $vms = Get-AzVM -ErrorAction SilentlyContinue $result = @{ TotalVMs = $vms.Count; WithVA = 0 } foreach ($vm in $vms) { $extensions = Get-AzVMExtension -ResourceGroupName $vm.ResourceGroupName -VMName $vm.Name -ErrorAction SilentlyContinue $hasVA = $extensions | Where-Object { $_.ExtensionType -like "*Qualys*" -or $_.ExtensionType -like "*VulnerabilityAssessment*" -or $_.Publisher -like "*Qualys*" } if ($hasVA) { $result.WithVA++ } } return $result } try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Vulnerability Assessment: $($r.WithVA)" -ForegroundColor $(if ($r.WithVA -gt 0) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nVulnerability Assessment: $($r.WithVA)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } # ================================================================================ # Standaard Invoke-* Functions (Auto-generated) # ================================================================================ function Invoke-Implementation { <# .SYNOPSIS Implementeert de configuratie #> [CmdletBinding()] param() Invoke-Remediation } function Invoke-Monitoring { <# .SYNOPSIS Controleert de huidige configuratie status #> [CmdletBinding()] param() $Monitoring = $true try { Connect-RequiredServices if ($Monitoring) { $r = Test-Compliance Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "$PolicyName" -ForegroundColor Cyan Write-Host "========================================" -ForegroundColor Cyan Write-Host "Total VMs: $($r.TotalVMs)" -ForegroundColor White Write-Host "With Vulnerability Assessment: $($r.WithVA)" -ForegroundColor $(if ($r.WithVA -gt 0) { 'Green' } else { 'Yellow' }) } else { $r = Test-Compliance Write-Host "`nVulnerability Assessment: $($r.WithVA)/$($r.TotalVMs) VMs" } } catch { Write-Error $_; exit 1 } } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }