Windows 10: Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Joey Cusimano · Nov 8, 2023

We have the Qualys Cloud Agent running on our VMs. It has typically been accurate with reporting vulnerabilities but lately there have been issues with old, resolved vulnerabilities still showing on the reporting. In particular, we have an example of a VM that had a vulnerable 7zip version that has since been updated weeks ago but persists on the report. I have attached a screenshot of the vulnerability showing since 9/27/2023 and not indicating the last time it was detected, despite the agent supposedly reporting in regularly with current results, as well as a screenshot of the inventory li

:)

Enfield · Nov 8, 2023

Microsoft Defender and Azure VDI

We have built a POC for Citrix Virtual Apps and Desktops on MS Azure. In Azure Advisor it is showing "Microsoft Defender for DNS should be enabled" and under the Subscription where we have the Virtual Desktops it is showing all the virtual desktops as suggestions and cloud connectors. My question is as follows:

1. I have installed Windows Defender on the image before I created the virtual desktops. So, it should not show up here, but it is showing up. (Citrix-001,002,003)

2. Citrix cloud connectors are created automatically when I created the virtual desktops. So, would it have Defender installed on it automatically?

3. Some of the machines under the list of virtual machines are showing as stopped and deallocated. I am not sure what those machines are. The ones that start with azr-prod-xxxxxx shown below.

Brink · Nov 8, 2023

Announcing Microsoft Azure IoT Device Agent V2 general availability

We are excited to announce the general availability of Microsoft Azure IoT Device Agent V2. The Microsoft Azure IoT Device Agent is an open-source, ready-to-build and package solution for Windows 10 IoT Enterprise and Windows 10 IoT Core operating systems that provides you with built-in capabilities to remotely provision, configure, monitor and manage your IoT devices.

When it comes to the widespread deployment of IoT devices, one of the key challenges is around remote manageability. IoT devices are deployed out in the field or on factory floors where direct device access is not always possible or practical. As an operator, you also want to ensure that you can deploy software and security updates across all the IoT devices in the field to protect and secure the data as well as the device.

What’s new

The Microsoft Azure IoT Device Agent has been in public preview since Jan 2019. If you were using our public preview version, we hope you found it useful and we are eager to know your feedback. With GA, you now have access to the following new features:

1) UWP Management Plugin and UWP bridge: You can now remotely manage your UWP app running on your devices using the UWP management plugin. The Device Agent now includes a UWP bridge which allows UWP applications to leverage a subset of the Device Agent capabilities such as TPM access and reboot.

2) Diagnostics and error reporting: Troubleshooting issues on your IoT devices is a lot easier with quick access to collect logs and error information from the device and upload them to Azure Storage.

3) Device Agent extensibility: Ready-to-use Visual Studio templates and Nugets make it easy for a device developer to create their own plugins and extend the Device Agent’s capabilities.

See the complete list of capabilities below for more information.

Microsoft Azure IoT Device Agent capabilities

The Microsoft Azure IoT Device Agent provides you with the following capabilities to support these scenarios:

Device provisioning: The Microsoft Azure IoT Device Agent integrates with the Azure Device Provisioning Service (DPS) client SDK to automatically provision and create the Azure IoT Hub identities of the device using the Azure Device Provisioning Service. The Device Agent registers the device with the Azure IoT Hub, ensuring the identity assignment of the device and applications running on it. The Microsoft Azure IoT Device Agent leverages Azure IoT Module twin such that each process that connects to the IoT Hub is associated to the same IoT Hub device. If your solution demands that you have a custom provisioning client, you can do so by downloading the Azure Device Provisioning Service device SDK and implementing your own provisioning service.

Manage cloud connectivity: Once the Microsoft Azure IoT Device Agent establishes the connection with the IoT Hub, it continues to manage the Azure cloud connection and the renewal of the SAS token before it expires.

Remote device management: The Microsoft Azure IoT Device Agent provides the following remote device management capabilities via built-in plugins:

Device info: Enables you to retrieve information like Device ID, manufacturer information, firmware version, etc.

Reboot: Enables you to remotely reboot the device or schedule a reboot.

Remote wipe: Enables you to wipe out all data on the device and restore the device to a clean state.

Factory reset: Enables you to apply a factory image on the device bringing it back to its original state.

Time management: Enables you to configure an NTP service and set the time zone on the device.

Windows Update management: Enables you to enforce OS update policies on the device.

Certificate management: Enables you to remotely install or uninstall certificates.

Windows telemetry management: Enables you to configure the level of telemetry that is being reported from the device.

Device Agent’s extensibility: As a device builder, you can write your own plugins which can interface with the Microsoft Azure IoT Device Agent. The Device Agent makes it easy for you to build your own custom code by providing you with the following hooks:

Includes a plugin model to bridge platform components with the agent and consequently with IoT Hub. The plugin model enables discovery, initialization, error reporting and state aggregation. The model includes a Visual Studio template and Nugets, which help you to quickly create your own plugin while abstracting the communication between the Device Agent and your plugin.

When a handler has dependencies on other handlers, Azure IoT Device Agent can make sure that the dependencies are processed in the right order.

Handlers have a versioning model to prevent mismatches in twin schemas or mismatches between plugin versions and the Device Agent.

Remote UWP application management: As a solution operator you can now remotely deploy, update, remove, start, or stop UWP applications on your devices using the UWP management plugin. On Windows IoT Core, you can also designate an application to be the start-up application.

Device Agent plugin capabilities in UWP apps: UWP applications can also leverage the UWP bridge, which enables the UWP application to leverage a limited subset of the functionalities of the Device Agent such as retrieving DPS enrollment information from the TPM or accessing admin-privileged functionality such as reboot.

Diagnostics and error reporting: Errors and diagnostics logs are now easily accessible for troubleshooting purposes using the Microsoft Azure IoT Device Agent.

Solution operators can now collect ETW logs on their IoT devices and upload them back to the cloud for inspection.

The error reports have been enhanced to now include details of the sub-system or the process where the error originally occurred helping users to better interpret error messages.

Getting started

Check out the Quick Start for more information or download the code or exe from this GitHub repo.

We want to hear from you!

As always, your feedback is very important to us! Please share your comments, questions, or concerns on our or comment below. We’re listening!
Click to expand...

Source: Microsoft Azure IoT Device Agent V2 general availability - Windows Developer Blog

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

Brink · Nov 8, 2023

Announcing Microsoft Azure IoT Device Agent V2 general availability

We are excited to announce the general availability of Microsoft Azure IoT Device Agent V2. The Microsoft Azure IoT Device Agent is an open-source, ready-to-build and package solution for Windows 10 IoT Enterprise and Windows 10 IoT Core operating systems that provides you with built-in capabilities to remotely provision, configure, monitor and manage your IoT devices.

When it comes to the widespread deployment of IoT devices, one of the key challenges is around remote manageability. IoT devices are deployed out in the field or on factory floors where direct device access is not always possible or practical. As an operator, you also want to ensure that you can deploy software and security updates across all the IoT devices in the field to protect and secure the data as well as the device.

What’s new

The Microsoft Azure IoT Device Agent has been in public preview since Jan 2019. If you were using our public preview version, we hope you found it useful and we are eager to know your feedback. With GA, you now have access to the following new features:

1) UWP Management Plugin and UWP bridge: You can now remotely manage your UWP app running on your devices using the UWP management plugin. The Device Agent now includes a UWP bridge which allows UWP applications to leverage a subset of the Device Agent capabilities such as TPM access and reboot.

2) Diagnostics and error reporting: Troubleshooting issues on your IoT devices is a lot easier with quick access to collect logs and error information from the device and upload them to Azure Storage.

3) Device Agent extensibility: Ready-to-use Visual Studio templates and Nugets make it easy for a device developer to create their own plugins and extend the Device Agent’s capabilities.

See the complete list of capabilities below for more information.

Microsoft Azure IoT Device Agent capabilities

The Microsoft Azure IoT Device Agent provides you with the following capabilities to support these scenarios:

Device provisioning: The Microsoft Azure IoT Device Agent integrates with the Azure Device Provisioning Service (DPS) client SDK to automatically provision and create the Azure IoT Hub identities of the device using the Azure Device Provisioning Service. The Device Agent registers the device with the Azure IoT Hub, ensuring the identity assignment of the device and applications running on it. The Microsoft Azure IoT Device Agent leverages Azure IoT Module twin such that each process that connects to the IoT Hub is associated to the same IoT Hub device. If your solution demands that you have a custom provisioning client, you can do so by downloading the Azure Device Provisioning Service device SDK and implementing your own provisioning service.

Manage cloud connectivity: Once the Microsoft Azure IoT Device Agent establishes the connection with the IoT Hub, it continues to manage the Azure cloud connection and the renewal of the SAS token before it expires.

Remote device management: The Microsoft Azure IoT Device Agent provides the following remote device management capabilities via built-in plugins:

Device info: Enables you to retrieve information like Device ID, manufacturer information, firmware version, etc.

Reboot: Enables you to remotely reboot the device or schedule a reboot.

Remote wipe: Enables you to wipe out all data on the device and restore the device to a clean state.

Factory reset: Enables you to apply a factory image on the device bringing it back to its original state.

Time management: Enables you to configure an NTP service and set the time zone on the device.

Windows Update management: Enables you to enforce OS update policies on the device.

Certificate management: Enables you to remotely install or uninstall certificates.

Windows telemetry management: Enables you to configure the level of telemetry that is being reported from the device.

Device Agent’s extensibility: As a device builder, you can write your own plugins which can interface with the Microsoft Azure IoT Device Agent. The Device Agent makes it easy for you to build your own custom code by providing you with the following hooks:

Includes a plugin model to bridge platform components with the agent and consequently with IoT Hub. The plugin model enables discovery, initialization, error reporting and state aggregation. The model includes a Visual Studio template and Nugets, which help you to quickly create your own plugin while abstracting the communication between the Device Agent and your plugin.

When a handler has dependencies on other handlers, Azure IoT Device Agent can make sure that the dependencies are processed in the right order.

Handlers have a versioning model to prevent mismatches in twin schemas or mismatches between plugin versions and the Device Agent.

Remote UWP application management: As a solution operator you can now remotely deploy, update, remove, start, or stop UWP applications on your devices using the UWP management plugin. On Windows IoT Core, you can also designate an application to be the start-up application.

Device Agent plugin capabilities in UWP apps: UWP applications can also leverage the UWP bridge, which enables the UWP application to leverage a limited subset of the functionalities of the Device Agent such as retrieving DPS enrollment information from the TPM or accessing admin-privileged functionality such as reboot.

Diagnostics and error reporting: Errors and diagnostics logs are now easily accessible for troubleshooting purposes using the Microsoft Azure IoT Device Agent.

Solution operators can now collect ETW logs on their IoT devices and upload them back to the cloud for inspection.

The error reports have been enhanced to now include details of the sub-system or the process where the error originally occurred helping users to better interpret error messages.

Getting started

Check out the Quick Start for more information or download the code or exe from this GitHub repo.

We want to hear from you!

As always, your feedback is very important to us! Please share your comments, questions, or concerns on our or comment below. We’re listening!
Click to expand...

Source: Microsoft Azure IoT Device Agent V2 general availability - Windows Developer Blog

Tweet

— Twitter API (@User) View on Twiiter

Windows 10: Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities - Similar Threads - Azure Defender Cloud

AMA agent extension showing unavailable on our Qualys Virtual Scanner Appliance Linux VMAzure

AMA agent extension showing unavailable on our Qualys Virtual Scanner Appliance Linux VMAzure

AMA agent extension showing unavailable on our Qualys Virtual Scanner Appliance Linux VMAzure

azure vm agent unknonw

azure vm agent unknonw

Azure Defender for Cloud - Qualys Agent Showing Resolved Vulnerabilities

Azure Monitoring Agent

Azure Monitoring Agent

Azure Monitoring Agent