Control: Azure > CIS v4.0 > 09 - Security Services > 09.01 - Microsoft Defender for Cloud > 09.01.10 - Ensure that Microsoft Defender for Cloud is configured to check VM operating systems for updates

Configures auditing against a CIS Benchmark item.

Level: 1

Ensure that the latest OS patches for all virtual machines are applied.

Windows and Linux virtual machines should be kept updated to address specific bugs or flaws, improve OS or application general stability, and fix security vulnerabilities.

Microsoft Defender for Cloud retrieves a list of available security and critical updates from Windows Update or Windows Server Update Services (WSUS), depending on which service is configured on a Windows VM. If a VM is missing a system update, the security center will recommend system updates be applied.

By default, patches are not automatically deployed.

Resource Types

This control targets the following resource types:

Azure > Security Center > Security Center

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv4-0#/control/types/r090110

Category URI

tmod:@turbot/cis#/control/categories/v070304

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv4-0#/control/types/r090110") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv4-0#/control/types/r090110'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv4-0#/control/types/r090110"