Azure Security Center - recommendation for Monitoring Agent about microsoft-defender-for-cloud

[mayaherskovic]

ASC recommendation to install “Monitoring Agent” is referring to a host level security agent for security data collection that Security Center depends on. Adding the VMSS/Host agent does not interfere with Azure Monitor for containers, you can enable them side by side.

[bsuchorowski]

I am just wondering how important to Security Center is a host level security agent. We are creating a k8s cluster via Terraform and setting anything on a VMSS level (created indirectly by azurerm_kubernetes_cluster resource) would be a bit tricky.

[mayaherskovic]

If you choose not to install the security agent on your VMSS hosts, you will only receive a subset of the threat protection benefits and security alerts. You'll still threat protection based on Kubernetes management activity, alerts related to network analysis and communications with malicious servers.

[bsuchorowski]

Terraform has just releaes a data source for VMSS so I will try to set host agent up.

[TomJanetscheck]

Hi @bsuchorowski,
have you been successful with setting up the host agent on VMSS using Terraform?

[bsuchorowski]

No, we haven't tried it yet. For now we configured both OMS Agents manually and it seems it overlaps in many aspects that causes us additonal costs. For example ContainerLog contains same logs (minor differences in formatting f.e additonal timestamp visible) from both agents.

Is there a way to disable ContainerLog events on VMSS agents and leave it running only on AKS agent?

[vishiy]

Docker (and containerd) based container monitoring will be auto disabled on AKS VMSS nodes, as part of VMSS agent install. We made this change last November. So there should not be ay duplicate data between containerinsights & VMSS/host agent (except heartbeats for each agent, which is not billed).

[kamilzzz]

@TomJanetscheck have you been able to configure it using Terraform?
From Azure ARM docs it doesn't seem to be possible to configure VMSS monitoring on AKS nodepools using ARM.