You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how to configure the different monitoring components that are available in Defender for Servers in Microsoft Defender for Cloud.
4
+
ms.topic: install-set-up-deploy
5
+
ms.date: 01/25/2024
6
+
---
7
+
8
+
# Configure monitoring coverage
9
+
10
+
Microsoft Defender for Cloud's Defender for Servers plans contains components that monitor your environments to provide extended coverage on your servers. Each of these components can be enabled, disabled or configured to your meet your specific requirements.
11
+
12
+
| Component | Availability | Description | Learn more |
13
+
|--|--|--|--|
14
+
|[Log Analytics agent](plan-defender-for-servers-agents.md)| Plan 1 and Plan 2 | Collects security-related configurations and event logs from the machine and stores the data in your Log Analytics default or custom workspace for analysis. |[Learn more](../azure-monitor/agents/log-analytics-agent.md) about the Log Analytics agent. |
15
+
|[Vulnerability assessment for machines](deploy-vulnerability-assessment-defender-vulnerability-management.md)| Plan 1 and Plan 2 |Enables vulnerability assessment on your Azure and hybrid machines. |[Learn more](monitoring-components.md) about how Defender for Cloud collects data. |
16
+
|[Endpoint protection](integration-defender-for-endpoint.md)| Plan 1 and Plan 2 | Enables protection powered by Microsoft Defender for Endpoint, including automatic agent deployment to your servers, and security data integration with Defender for Cloud |[Learn more](integration-defender-for-endpoint.md) about endpoint protection. |
17
+
|[Agentless scanning for machines](concept-agentless-data-collection.md)| Plan 2 | Scans your machines for installed software and vulnerabilities without relying on agents or impacting machine performance. |[Learn more](concept-agentless-data-collection.md) about agentless scanning for machines. |
18
+
19
+
When you enable Defender for Servers plan 2, all of these components are toggled to **On** by default.
20
+
21
+
## Configure Log Analytics agent
22
+
23
+
After enabling the Log Analytics agent, you'll be presented with the option to select which workspace should be utilized.
24
+
25
+
**To configure the Log Analytics agent**:
26
+
27
+
1. Select **Edit configuration**.
28
+
29
+
:::image type="content" source="media/configure-servers-coverage/edit-configuration-log.png" alt-text="Screenshot that shows you where on the screen you need to select edit configuration, to edit the log analytics agent/azure monitor agent." lightbox="media/configure-servers-coverage/edit-configuration-log.png":::
30
+
31
+
1. Select either a **Default workspace(s)** or a **Custom workspace** depending on your need.
32
+
33
+
:::image type="content" source="media/configure-servers-coverage/auto-provisioning-screen.png" alt-text="Screenshot of the auto provisioning configuration screen with the available options to select." lightbox="media/configure-servers-coverage/auto-provisioning-screen.png":::
34
+
35
+
1. Select **Apply**.
36
+
37
+
1. Select **Continue**.
38
+
39
+
## Configure vulnerability assessment for machines
40
+
41
+
Vulnerability assessment for machines allows you to select between two vulnerability assessment solutions:
42
+
43
+
- Microsoft Defender Vulnerability Management
44
+
- Microsoft Defender for Cloud integrated Qualys scanner
45
+
46
+
**To select either of the vulnerability assessment solutions**:
47
+
48
+
1. Select **Edit configuration**.
49
+
50
+
:::image type="content" source="media/configure-servers-coverage/vulnerability-edit.png" alt-text="Screenshot that shows you where to select edit for vulnerabilities assessment for machines." lightbox="media/configure-servers-coverage/vulnerability-edit.png":::
51
+
52
+
1. In the Extension deployment configuration window, select either of the solutions depending on your need.
53
+
54
+
1. Select **Apply**.
55
+
56
+
1. Select **Continue**.
57
+
58
+
## Configure endpoint protection
59
+
60
+
With Microsoft Defender for Servers, you enable the protections provided by [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) to your server resources. Defender for Endpoint includes automatic agent deployment to your servers, and security data integration with Defender for Cloud.
61
+
62
+
To configure endpoint protection:
63
+
64
+
1. Toggle the switch to **On**.
65
+
66
+
1. Select **Continue**.
67
+
68
+
## Configure agentless scanning for machines
69
+
70
+
Defender for Cloud has the ability to scan your Azure machines for installed software and vulnerabilities without requiring you to install agents, have network connectivity or affect your machine's performance.
71
+
72
+
**To configure agentless scanning for machines**:
73
+
74
+
1. Select **Edit configuration**.
75
+
76
+
:::image type="content" source="media/configure-servers-coverage/agentless-scanning-edit.png" alt-text="Screenshot that shows where you need to select to edit the configuration of the agentless scanner." lightbox="media/configure-servers-coverage/agentless-scanning-edit.png":::
77
+
78
+
1. Enter a tag name and tag value for any machines to be excluded from scans.
79
+
80
+
1. Select **Apply**.
81
+
82
+
1. Select **Continue**.
83
+
84
+
Learn more about agentless scanning and how to [enable agentless scanning](enable-agentless-scanning-vms.md) on other cloud environments.
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/tutorial-enable-servers-plan.md
+10-69Lines changed: 10 additions & 69 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,6 +43,8 @@ You can enable the Defender for Servers plan from the Environment settings page
43
43
44
44
:::image type="content" source="media/tutorial-enable-servers-plan/enable-servers-plan.png" alt-text="Screenshot that shows you how to toggle the Defender for Servers plan to on." lightbox="media/tutorial-enable-servers-plan/enable-servers-plan.png":::
45
45
46
+
Once the plan has been enabled, you have the ability to [configure the monitoring settings](configure-servers-coverage.md) to suit your needs.
47
+
46
48
### Select a Defender for Servers plan
47
49
48
50
When you enable the Defender for Servers plan, you're then given the option to select which plan - Plan 1 or Plan 2 - to enable. There are two plans you can choose from that offer different levels of protections for your resources.
@@ -71,75 +73,7 @@ When you enable the Defender for Servers plan, you're then given the option to s
71
73
72
74
1. Select **Save**.
73
75
74
-
### Configure monitoring coverage
75
-
76
-
There are components that can be enabled and configured to provide extra protections to your environments in the Defender for Servers plans.
77
-
78
-
| Component | Description | Learn more |
79
-
|:--:|:--:|:--:|
80
-
|[Log Analytics agent](plan-defender-for-servers-agents.md)| Collects security-related configurations and event logs from the machine and stores the data in your Log Analytics workspace for analysis. |[Learn more](../azure-monitor/agents/log-analytics-agent.md) about the Log Analytics agent. |
81
-
|[Vulnerability assessment for machines](deploy-vulnerability-assessment-defender-vulnerability-management.md)| Enables vulnerability assessment on your Azure and hybrid machines. |[Learn more](monitoring-components.md) about how Defender for Cloud collects data. |
82
-
|[Endpoint protection](integration-defender-for-endpoint.md)| Enables protection powered by Microsoft Defender for Endpoint, including automatic agent deployment to your servers, and security data integration with Defender for Cloud |[Learn more](integration-defender-for-endpoint.md) about endpoint protection |
83
-
|[Agentless scanning for machines](concept-agentless-data-collection.md)| Scans your machines for installed software and vulnerabilities without relying on agents or impacting machine performance. |[Learn more](concept-agentless-data-collection.md) about agentless scanning for machines. |
84
-
85
-
Toggle the corresponding switch to **On**, to enable any of these options.
86
-
87
-
### Configure Log Analytics agent
88
-
89
-
After enabling the Log Analytics agent, you'll be presented with the option to select which workspace should be utilized.
90
-
91
-
**To configure the Log Analytics agent**:
92
-
93
-
1. Select **Edit configuration**.
94
-
95
-
:::image type="content" source="media/tutorial-enable-servers-plan/edit-configuration-log.png" alt-text="Screenshot that shows you where on the screen you need to select edit configuration, to edit the log analytics agent/azure monitor agent." lightbox="media/tutorial-enable-servers-plan/edit-configuration-log.png":::
96
-
97
-
1. Select either a **Default workspace(s)** or a **Custom workspace** depending on your need.
98
-
99
-
:::image type="content" source="media/tutorial-enable-servers-plan/auto-provisioning-screen.png" alt-text="Screenshot of the auto provisioning configuration screen with the available options to select." lightbox="media/tutorial-enable-servers-plan/auto-provisioning-screen.png":::
100
-
101
-
1. Select **Apply**.
102
-
103
-
### Configure vulnerability assessment for machines
104
-
105
-
Vulnerability assessment for machines allows you to select between two vulnerability assessment solutions:
106
-
107
-
- Microsoft Defender Vulnerability Management
108
-
- Microsoft Defender for Cloud integrated Qualys scanner
109
-
110
-
**To select either of the vulnerability assessment solutions**:
111
-
112
-
1. Select **Edit configuration**.
113
-
114
-
:::image type="content" source="media/tutorial-enable-servers-plan/vulnerability-edit.png" alt-text="Screenshot that shows you where to select edit for vulnerabilities assessment for machines." lightbox="media/tutorial-enable-servers-plan/vulnerability-edit.png":::
115
-
116
-
1. In the Extension deployment configuration window, select either of the solutions depending on your need.
117
-
118
-
1. Select **Apply**.
119
-
120
-
## Configure endpoint protection
121
-
122
-
With Microsoft Defender for Servers, you enable the protections provided by [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) to your server resources. Defender for Endpoint includes automatic agent deployment to your servers, and security data integration with Defender for Cloud.
123
-
124
-
**To configure endpoint protection**:
125
-
126
-
1. Toggle the switch to **On**.
127
-
128
-
### Configure agentless scanning for machines
129
-
130
-
Defender for Cloud has the ability to scan your Azure machines for installed software and vulnerabilities without requiring you to install agents, have network connectivity or affect your machine's performance.
131
-
132
-
**To configure agentless scanning for machines**:
133
-
134
-
1. Select **Edit configuration**.
135
-
136
-
:::image type="content" source="media/tutorial-enable-servers-plan/agentless-scanning-edit.png" alt-text="Screenshot that shows where you need to select to edit the configuration of the agentless scanner." lightbox="media/tutorial-enable-servers-plan/agentless-scanning-edit.png":::
137
-
138
-
1. Enter a tag name and tag value for any machines to be excluded from scans.
139
-
140
-
1. Select **Apply**.
141
-
142
-
Learn more about agentless scanning and how to [enable agentless scanning](enable-agentless-scanning-vms.md) on other cloud environments.
76
+
Once the plan has been enabled, you have the ability to [configure the monitoring settings](configure-servers-coverage.md) to suit your needs.
Once the plan has been enabled, you have the ability to [configure the monitoring settings](configure-servers-coverage.md) to suit your needs.
94
+
159
95
### Enablement via REST API
160
96
161
97
The ability to enable or disable Defender for Servers at the resource level is available exclusively via REST API. Learn how to [interact with the API](/rest/api/defenderforcloud/pricings) to manage your Defender for Servers at the resource or subscription level.
@@ -175,6 +111,8 @@ Since Microsoft Defender for Endpoint deployment for eligible machines is a near
175
111
- If you plan to roll out and enable Servers Plan 1/Plan 2 at the subscription level and exclude individual existing VMs, make sure you exclude the VMs before (or at the same time) you enable the plan at the subscription level.
176
112
- When you plan to exclude new VMs created under a subscription already enabled for P1/P2, make sure you exclude them during or shortly after creation time, to avoid unintentional deployment of Microsoft Defender for Endpoint.
177
113
114
+
Once the plan has been enabled, you have the ability to [configure the monitoring settings](configure-servers-coverage.md) to suit your needs.
115
+
178
116
### Enablement at scale
179
117
180
118
Use the following base script file to customize it for your specific needs.
@@ -183,6 +121,8 @@ Use the following base script file to customize it for your specific needs.
183
121
1. Select whether to set pricing by **tag** or by **resource group**.
184
122
1. Follow the onscreen instructions.
185
123
124
+
Once the plan has been enabled, you have the ability to [configure the monitoring settings](configure-servers-coverage.md) to suit your needs.
125
+
186
126
### Monitoring coverage status
187
127
188
128
To monitor your coverage status, you can use the inventory. In the main menu, select **Inventory** and then check the **plan status** in the “Defender for cloud” column:
@@ -194,4 +134,5 @@ To monitor your coverage status, you can use the inventory. In the main menu, se
0 commit comments