@@ -2,54 +2,95 @@ title: Remediate machine vulnerabilities description: Learn about remediating machine vulnerabilities in Microsoft Defender for Cloud. ms.topic: how-to-ms.date: 02/19/2025+ms.date: 08/31/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to review and remediate machine vulnerability findings so I can reduce risk in my environment. ai-usage: ai-assisted ---  # Remediate machine vulnerabilities -The Defender for Servers plan in Microsoft Defender for Cloud provides [agentless and agent-based vulnerability scanning](auto-deploy-vulnerability-assessment.md) for protected machines using Microsoft Defender Vulnerability Management.+The Defender for Servers plan in Microsoft Defender for Cloud scans protected machines for vulnerabilities. It supports both [agentless and agent-based scanning](auto-deploy-vulnerability-assessment.md) through Microsoft Defender Vulnerability Management.  **Requirement** | **Details** --- | ----**Plan** | For agentless vulnerability scanning, Defender for Servers Plan 2 must be enabled, and agentless scanning must be on in the plan.<br/><br/>For agent-based scanning with the Microsoft Defender for Endpoint agent, Defender for Servers Plan 1 or Defender for Servers Plan 2 must be enabled, and Defender for Endpoint integration must be enabled.-**Agentless scanning** | [Review the prerequisites](enable-agentless-scanning-vms.md#prerequisites) for agentless scanning.+**Plan** | For agentless scanning, enable Defender for Servers Plan 2 and turn on agentless scanning in the plan.<br/><br/>For agent-based scanning, enable Defender for Servers Plan 1 or Plan 2 and turn on Defender for Endpoint integration.+**Agentless scanning** | [Review the prerequisites](enable-agentless-scanning-vms.md#before-you-begin) for agentless scanning. **Agent-based scanning** | [Review the prerequisites](enable-defender-for-endpoint.md#prerequisites) for Defender for Endpoint integration in Defender for Servers.  ## View scan findings -To view vulnerability assessment findings (from all of your configured scanners) and remediate identified vulnerabilities:+To review and remediate machine vulnerability findings: -1. From Defender for Cloud's menu, open the **Recommendations** page.+1. In Defender for Cloud, go to **Recommendations**. -1. Select the recommendation **Machines should have vulnerability findings resolved**.+1. Select **Vulnerabilities** to view vulnerability recommendations. -    Defender for Cloud shows findings for all VMs in the selected subscriptions. Findings are ordered by severity.+1. Use the available filters to scope the results to the resources you want to review. -    :::image type="content" source="media/remediate-vulnerability-findings-vm/vulnerabilities-should-be-remediated.png" alt-text="The findings from your vulnerability assessment solutions for all selected subscriptions." lightbox="media/remediate-vulnerability-findings-vm/vulnerabilities-should-be-remediated.png":::+1. To review vulnerability findings for a specific resource, select **Group by resource**, and then select the resource. -1. To filter findings by one VM, open the "Affected resources" section and select the VM you want. You can also select a VM from the resource health view to see all relevant recommendations for that resource.+1. Select an individual vulnerability recommendation to review its details. -    Defender for Cloud shows the findings for that VM, ordered by severity.+1. Review the recommendation details, including: -1. To learn more about a specific vulnerability, select it.--    :::image type="content" source="media/remediate-vulnerability-findings-vm/vulnerability-details.png" alt-text="Details pane for a specific vulnerability." lightbox="media/remediate-vulnerability-findings-vm/vulnerability-details.png":::--    The details pane includes the following vulnerability information:--    - Links to all relevant CVEs (where available)+    - The affected resource+    - Relevant CVEs, when available     - Remediation steps-    - Any more reference pages+    - Additional reference information, when available -1. To remediate a finding, follow the remediation steps from the details pane.+1. To remediate the finding, follow the remediation guidance for the selected recommendation.  ## Export the results -Export vulnerability assessment results with [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/). Azure Resource Graph gives you quick access to resource data across cloud environments. You can filter, group, and sort results to query information across Azure subscriptions from the portal or programmatically.--For full instructions and a sample ARG query, see the following Tech Community post: [Exporting vulnerability assessment results in Microsoft Defender for Cloud](https://techcommunity.microsoft.com/t5/azure-security-center/exporting-vulnerability-assessment-results-in-azure-security/ba-p/1212091).+You can use [Azure Resource Graph](/azure/governance/resource-graph/) to query and export machine vulnerability findings across your environment.++The following query returns individual software update recommendations for Azure virtual machines:++```kusto+securityresources+| where type == "microsoft.security/assessments"+| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"+| where properties.metadata.recommendationCategory == "SoftwareUpdate"+| extend DisplayName = tostring(properties.displayName)+| extend Severity = tostring(properties.metadata.severity)+| extend DetectedVersions = tostring(properties.additionalData.DetectedSoftwareVersions)+| extend FixedVersion = tostring(properties.additionalData.FixedVersion)+| extend CvesDetails = parse_json(tostring(properties.additionalData.CvesDetails))+| mv-expand CveDetail = CvesDetails+| extend CveId = tostring(CveDetail.CveId)+| project DisplayName, Severity, DetectedVersions, FixedVersion, CveId+```++> [!NOTE]+> The `CvesDetails` object continues to provide the `CveId` for each vulnerability. To retrieve additional CVE details, query the `microsoft.security/cvedetails` resource type:+>+> ```kusto+> securityresources+> | where type =~ "microsoft.security/cvedetails"+> ```++The following example joins software update and service upgrade recommendations with CVE details so you can export the assessment and the extended CVE information together:++```kusto+securityresources+| where type == "microsoft.security/assessments"+| where properties.metadata.recommendationCategory in ("SoftwareUpdate", "ServiceUpgrade")+| extend CvesDetails = parse_json(tostring(properties.additionalData.CvesDetails))+| mv-expand CveDetails = CvesDetails+| extend CveId = tostring(CveDetails.CveId)+| where isnotempty(CveId)+| project Assessment = tostring(properties.displayName), CveId, CveDetails+| join kind=inner (+    securityresources+    | where type =~ "microsoft.security/cvedetails"+    | extend CveId = tostring(properties.cveId)+    | project CveId, CveExtendedDetails = properties+) on CveId+| project Assessment, CveId, CveDetails, CveExtendedDetails+```++For more information about migrating Azure Resource Graph queries to individual recommendations, see [Transition from grouped to individual recommendations](transition-grouped-individual-recommendations.md).  ## Next steps