Windows 10: AMA agent extension showing unavailable on our Qualys Virtual Scanner Appliance Linux VMAzure

Hi Support Community,One of our Azure Linux VM is not giving Heartbeat logs, We troubleshooted the DCR and VM extension and identified the AMA agent is unavailable.Can someone help me with that?Also, Does Qualys Virtual Scanner Appliance supports SSH and AMA agent extension?Thanks in advance.

:)

 

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

We have the Qualys Cloud Agent running on our VMs. It has typically been accurate with reporting vulnerabilities but lately there have been issues with old, resolved vulnerabilities still showing on the reporting. In particular, we have an example of a VM that had a vulnerable 7zip version that has since been updated weeks ago but persists on the report. I have attached a screenshot of the vulnerability showing since 9/27/2023 (and not indicating the last time it was detected, despite the agent supposedly reporting in regularly with current results), as well as a screenshot of the inventory list for this VM which clearly shows a version of 7zip above the threshold for the vulnerability and showing 0 under "known vulnerabilities".

Why is this result still showing in the Microsoft Defender for Cloud Recommendations? We have weekly SecOps meetings to discuss these results and this item comes up every week despite having been fixed weeks ago. We have tried the following:
- Restarting the Qualys Agent service on the machine under services.msc
- Checking for other versions of 7z.exe on the machine in other locations
- Uninstalling, then reinstalling 7zip
- Uninstalling, then reinstalling the Qualys Agent

Having stale results makes our meetings very inefficient and has us spinning our wheels when it comes to cleaning up our secure score and reports which we use to report our security posture to parties of interest. We need to determine the cause of these discrepancies and prevent it from happening in the future. Additionally:
- Is there any way to restart the Qualys Agent without remoting into the VM (through the portal)?
- Is there any way to uninstall/reinstall the Agent through the portal, without having to remote into the machine?
- Why don't some vulnerability results show the "Last Found" date to indicate the last time the agent findings updated? This would be helpful with troubleshooting.

 

Cannot use Virtual Agent

• No
• Version: 1709
• Build: 16299
• I only have the built in Windows Defender
• I'm using Internet Explorer and am using Microsoft Edge to use the Virtual Agent right now
• It's just Microsoft that's having the issue
• I only use my home network

 

Disable Virtual Agent

Hi,

The Virtual Agent on the support page of Microsoft is a feature and part of the web page. If you really want to disable it, you can refer to the steps provided by other community member in this thread as a workaround. If you want the support page of Microsoft
to have an option to disable the Virtual Agent, you can refer to the reply of
Mark Isi.

Regards.