Azure용 Microsoft 맬웨어 방지 프로그램을 사용하도록 설정하고 구성하는 코드 샘플

이 문서에서는 다음을 비롯한 다양한 Azure 서비스에 대해 Microsoft 맬웨어 방지 프로그램을 사용하도록 설정하고 구성하는 PowerShell 코드 샘플을 제공합니다.

• Azure Resource Manager VM
• Azure Service Fabric 클러스터
• 확장 지원을 사용하는 Azure Cloud Services
• Azure Arc 지원 서버

이러한 샘플을 사용하여 Azure 환경에서 Microsoft 맬웨어 방지 확장을 배포하고 구성할 수 있습니다.

Azure Resource Manager VM에 Microsoft 맬웨어 방지 배포

# Script to add Microsoft Antimalware extension to Azure Resource Manager VMs
# Specify your subscription ID
$subscriptionId= " SUBSCRIPTION ID HERE "
# specify location, resource group, and VM for the extension
$location = " LOCATION HERE " # eg., “Southeast Asia” or “Central US”
$resourceGroupName = " RESOURCE GROUP NAME HERE "
$vmName = " VM NAME HERE "

# Enable Antimalware with default policies
$settingString = ‘{"AntimalwareEnabled": true}’;
# Enable Antimalware with custom policies
# $settingString = ‘{
# "AntimalwareEnabled": true,
# "RealtimeProtectionEnabled": true,
# "ScheduledScanSettings": {
#                             "isEnabled": true,
#                             "day": 0,
#                             "time": 120,
#                             "scanType": "Quick"
#                             },
# "Exclusions": {
#            "Extensions": ".ext1,.ext2",
#                  "Paths":"",
#                  "Processes":"sampl1e1.exe, sample2.exe"
#             },
# "SignatureUpdates": {
#                               "FileSharesSources": “”,
#                               "FallbackOrder”: “”,
#                               "ScheduleDay": 0,
#                               "UpdateInterval": 0,
#                       },
# "CloudProtection": true         
#
# }’;
# Login to your Azure Resource Manager Account and select the Subscription to use
Login-AzureRmAccount
 
Select-AzureRmSubscription -SubscriptionId $subscriptionId
# retrieve the most recent version number of the extension
$allVersions= (Get-AzureRmVMExtensionImage -Location $location -PublisherName “Microsoft.Azure.Security” -Type “IaaSAntimalware”).Version
$versionString = $allVersions[($allVersions.count)-1].Split(“.”)[0] + “.” + $allVersions[($allVersions.count)-1].Split(“.”)[1]
# set the extension using prepared values
# ****—-Use this script till cmdlets address the -SettingsString format issue we observed ****—-
Set-AzureRmVMExtension -ResourceGroupName $resourceGroupName -Location $location -VMName $vmName -Name "IaaSAntimalware" -Publisher “Microsoft.Azure.Security” -ExtensionType “IaaSAntimalware” -TypeHandlerVersion $versionString -SettingString $settingString  

Azure Service Fabric 클러스터에 Microsoft 맬웨어 방지 프로그램 추가

Azure Service Fabric은 Azure 가상 머신 확장 집합을 사용하여 Service Fabric 클러스터를 만듭니다. 현재 Service Fabric 클러스터를 만드는 데 사용되는 가상 머신 확장 집합 템플릿은 맬웨어 방지 확장에서 사용하도록 설정되지 않습니다. 따라서 확장 집합에서 안티멀웨어를 별도로 사용하도록 설정해야 합니다. 확장 집합에서 사용하도록 설정하면 가상 머신 확장 집합에서 만든 모든 노드가 확장을 상속하고 자동으로 가져옵니다.

아래 코드 샘플에서는 AzureRmVmss PowerShell cmdlet을 사용하여 IaaS 맬웨어 방지 확장을 사용하도록 설정하는 방법을 보여 줍니다.

# Script to add Microsoft Antimalware extension to VM Scale Set(VMSS) and Service Fabric Cluster(in turn it used VMSS)
# Login to your Azure Resource Manager Account and select the Subscription to use
Login-AzureRmAccount
# Specify your subscription ID
$subscriptionId="SUBSCRIPTION ID HERE"
Select-AzureRmSubscription -SubscriptionId $subscriptionId
# Specify location, resource group, and VM Scaleset for the extension
$location = "LOCATION HERE" # eg., “West US or Southeast Asia” or “Central US”
$resourceGroupName = "RESOURCE GROUP NAME HERE"
$vmScaleSetName = "YOUR VM SCALE SET NAME"

# Configuration.JSON configuration file can be customized as per MSDN documentation: https://msdn.microsoft.com/en-us/library/dn771716.aspx
$settingString = ‘{"AntimalwareEnabled": true}’;
# Enable Antimalware with custom policies
# $settingString = ‘{
# "AntimalwareEnabled": true,
# "RealtimeProtectionEnabled": true,
# "ScheduledScanSettings": {
#                             "isEnabled": true,
#                             "day": 0,
#                             "time": 120,
#                             "scanType": "Quick"
#                             },
# "Exclusions": {
#            "Extensions": ".ext1,.ext2",
#                  "Paths":"",
#                  "Processes":"sampl1e1.exe, sample2.exe"
#             } ,
# "SignatureUpdates": {
#                               "FileSharesSources": “”,
#                               "FallbackOrder”: “”,
#                               "ScheduleDay": 0,
#                               "UpdateInterval": 0,
#                       },
# "CloudProtection": true
# }’;

# retrieve the most recent version number of the extension
$allVersions= (Get-AzureRmVMExtensionImage -Location $location -PublisherName “Microsoft.Azure.Security” -Type “IaaSAntimalware”).Version
$versionString = $allVersions[($allVersions.count)-1].Split(“.”)[0] + “.” + $allVersions[($allVersions.count)-1].Split(“.”)[1]
$VMSS = Get-AzureRmVmss -ResourceGroupName $resourceGroupName -VMScaleSetName $vmScaleSetName
Add-AzureRmVmssExtension -VirtualMachineScaleSet $VMSS -Name “IaaSAntimalware” -Publisher “Microsoft.Azure.Security” -Type “IaaSAntimalware” -TypeHandlerVersion $versionString
Update-AzureRmVmss -ResourceGroupName $resourceGroupName -Name $vmScaleSetName -VirtualMachineScaleSet $VMSS 

추가 지원을 사용하여 Azure Cloud Service에 Microsoft 맬웨어 방지 프로그램 추가

아래 코드 샘플에서는 PowerShell cmdlet을 통해 확장 지원(CS-ES)을 사용하여 Azure Cloud Service에 Microsoft 맬웨어 방지 프로그램을 추가하거나 구성하는 방법을 보여 줍니다.

# Create Antimalware extension object, where file is the AntimalwareSettings
$xmlconfig = [IO.File]::ReadAllText("C:\path\to\file.xml")
$extension =  New-AzCloudServiceExtensionObject  -Name "AntimalwareExtension" -Type "PaaSAntimalware" -Publisher "Microsoft.Azure.Security" -Setting $xmlconfig -TypeHandlerVersion "1.5" -AutoUpgradeMinorVersion $true

# Get existing Cloud Service
$cloudService = Get-AzCloudService -ResourceGroup "ContosOrg" -CloudServiceName "ContosoCS"

# Add Antimalware extension to existing Cloud Service extension object
$cloudService.ExtensionProfile.Extension = $cloudService.ExtensionProfile.Extension + $extension

# Update Cloud Service
$cloudService | Update-AzCloudService

다음은 프라이빗 구성 XML 파일의 예입니다.

<?xml version="1.0" encoding="utf-8"?>
<AntimalwareConfig
    xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
    <AntimalwareEnabled>true</AntimalwareEnabled>
    <RealtimeProtectionEnabled>true</RealtimeProtectionEnabled>
    <ScheduledScanSettings isEnabled="true" day="1" time="120" scanType="Full" />
    <Exclusions>
        <Extensions>
            <Extension>.ext1</Extension>
            <Extension>.ext2</Extension>
        </Extensions>
        <Paths>
            <Path>c:\excluded-path-1</Path>
            <Path>c:\excluded-path-2</Path>
        </Paths>
        <Processes>
            <Process>excludedproc1.exe</Process>
            <Process>excludedproc2.exe</Process>
        </Processes>
    </Exclusions>
</AntimalwareConfig>

Azure Arc 지원 서버용 Microsoft 맬웨어 방지 프로그램 추가

아래 코드 샘플에서는 PowerShell cmdlet을 통해 Azure Arc 지원 서버용 Microsoft 맬웨어 방지 프로그램을 추가하는 방법을 보여 줍니다.

#Before using Azure PowerShell to manage VM extensions on your hybrid server managed by Azure Arc-enabled servers, you need to install the Az.ConnectedMachine module. Run the following command on your Azure Arc-enabled server:
#If you have Az.ConnectedMachine installed, please make sure the version is at least 0.4.0
install-module -Name Az.ConnectedMachine
Import-Module -name Az.ConnectedMachine

# specify location, resource group, and VM for the extension
$subscriptionid =" SUBSCRIPTION ID HERE "
$location = " LOCATION HERE " # eg., “Southeast Asia” or “Central US”
$resourceGroupName = " RESOURCE GROUP NAME HERE "
$machineName = "MACHINE NAME HERE "

# Enable Antimalware with default policies
$setting = @{"AntimalwareEnabled"=$true}
# Enable Antimalware with custom policies
$setting2 = @{
"AntimalwareEnabled"=$true;
"RealtimeProtectionEnabled"=$true;
"ScheduledScanSettings"= @{
                            "isEnabled"=$true;
                            "day"=0;
                            "time"=120;
                            "scanType"="Quick"
                            };
"Exclusions"= @{
           "Extensions"=".ext1, .ext2";
                 "Paths"="";
                 "Processes"="sampl1e1.exe, sample2.exe"
            };
"SignatureUpdates"= @{
                              "FileSharesSources"=“”;
                              "FallbackOrder”=“”;
                              "ScheduleDay"=0;
                              "UpdateInterval"=0;
                      };
"CloudProtection"=$true
}
# Will be prompted to login 
Connect-AzAccount 
# Enable Antimalware with the policies
New-AzConnectedMachineExtension -Name "IaaSAntimalware" -ResourceGroupName $resourceGroupName -MachineName $machineName -Location $location -SubscriptionId $subscriptionid -Publisher “Microsoft.Azure.Security” -Settings $setting -ExtensionType “IaaSAntimalware”

다음 단계

• Azure Cloud Services 및 Virtual Machines용 Microsoft 맬웨어 방지 프로그램
• 클라우드용 Microsoft Defender