​
Event Information

  1. The Microsoft.ClassicCompute.virtualMachines.stop.action event in Azure for AzureVirtualMachines refers to the action of stopping a virtual machine in the classic deployment model.

  2. This event indicates that a user or an automated process has initiated the stop action on a virtual machine in Azure.

  3. When this event occurs, the virtual machine is gracefully shut down, and any running processes or applications are stopped before the virtual machine is powered off. This helps to ensure data integrity and prevent any potential data loss.

​
Examples

  1. Unauthorized access: If security is impacted with the Microsoft.ClassicCompute.virtualMachines.stop.action in Azure for AzureVirtualMachines, it could potentially allow unauthorized access to the virtual machine. This action could be exploited by an attacker to gain unauthorized control over the virtual machine, leading to potential data breaches or unauthorized activities.

  2. Data loss or corruption: Stopping a virtual machine abruptly without proper shutdown procedures can result in data loss or corruption. If critical processes or applications are running on the virtual machine at the time of the stop action, it may not have the opportunity to save data or complete necessary tasks, leading to potential data loss or corruption.

  3. Service disruption: Stopping a virtual machine can cause service disruption, impacting the availability of applications or services hosted on the virtual machine. If the virtual machine is part of a critical infrastructure or hosting important services, an unplanned stop action can result in downtime and affect business operations. It is important to consider the impact on service availability and plan for appropriate maintenance windows or failover mechanisms to minimize disruption.

​
Remediation

​
Using Console

To remediate the issues for Azure Virtual Machines using the Azure console, you can follow these step-by-step instructions:

  1. Enable Azure Security Center:

    • Go to the Azure portal and search for “Security Center” in the search bar.
    • Select “Security Center” from the results and click on it.
    • In the Security Center dashboard, click on “Pricing & settings” in the left menu.
    • Choose the subscription and resource group where your Azure Virtual Machines are located.
    • Click on “Apply to all resources” to enable Security Center for all resources in the selected subscription and resource group.
    • Review the pricing tier options and select the appropriate tier for your needs.
    • Click on “Save” to enable Security Center.

  2. Implement Network Security Groups (NSGs):

    • Go to the Azure portal and search for “Virtual Machines” in the search bar.
    • Select “Virtual Machines” from the results and click on it.
    • Choose the virtual machine that you want to secure with NSGs.
    • In the virtual machine’s overview page, click on “Networking” in the left menu.
    • Under “Inbound port rules”, click on “Add inbound port rule” to define the allowed inbound traffic.
    • Specify the necessary details such as source IP address, destination port range, and protocol.
    • Repeat the above step to add additional inbound port rules as needed.
    • Click on “Save” to apply the NSG rules to the virtual machine.

  3. Implement Azure Backup:

    • Go to the Azure portal and search for “Recovery Services vaults” in the search bar.
    • Select “Recovery Services vaults” from the results and click on it.
    • Click on “Add” to create a new Recovery Services vault.
    • Specify the necessary details such as subscription, resource group, and vault name.
    • Choose the appropriate region for the vault.
    • Click on “Review + create” and then “Create” to create the vault.
    • Once the vault is created, go to the virtual machine that you want to backup.
    • In the virtual machine’s overview page, click on “Backup” in the left menu.
    • Click on “Backup now” to initiate an immediate backup of the virtual machine.
    • Follow the prompts to configure the backup settings and retention policy.
    • Click on “Enable backup” to start the backup process.

Note: The above instructions provide a general guideline for remediating the mentioned issues in Azure using the Azure console. The specific steps may vary depending on your Azure subscription, resource group, and virtual machine configurations. It is recommended to refer to the official Azure documentation for detailed instructions and best practices.

​
Using CLI

To remediate the issues for Azure Virtual Machines using Azure CLI, you can follow these steps:

  1. Enable Azure Security Center for Azure Virtual Machines:

    • Use the Azure CLI command az vm update --name <vm_name> --resource-group <resource_group_name> --set "properties.securityProfile.securityCenterEnabled=true" to enable Azure Security Center for a specific virtual machine.

  2. Configure Network Security Groups (NSGs) for Azure Virtual Machines:

    • Use the Azure CLI command az network nsg rule create --name <rule_name> --nsg-name <nsg_name> --resource-group <resource_group_name> --priority <priority_number> --source-address-prefixes <source_address_prefix> --destination-port-ranges <destination_port_range> --access <access_type> --protocol <protocol> to create a new NSG rule for a specific NSG and virtual machine.

  3. Implement Azure Backup for Azure Virtual Machines:

    • Use the Azure CLI command az backup protection enable-for-vm --vm <vm_name> --vault-name <vault_name> --resource-group <resource_group_name> --policy-name <policy_name> to enable Azure Backup protection for a specific virtual machine. Replace the placeholders with the appropriate values for your environment.

Please note that the actual commands may vary depending on your specific requirements and configurations. Make sure to replace the placeholders with the actual values relevant to your Azure environment.

​
Using Python

To remediate the issues for Azure Virtual Machines using Python, you can use the Azure SDK for Python. Here are three examples of how you can remediate common issues:

  1. Example 1: Start a stopped virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Create a ComputeManagementClient
compute_client = ComputeManagementClient(credential, subscription_id)

# Specify the resource group and virtual machine name
resource_group_name = "your_resource_group_name"
vm_name = "your_vm_name"

# Start the virtual machine
compute_client.virtual_machines.start(resource_group_name, vm_name)
  1. Example 2: Resize a virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Create a ComputeManagementClient
compute_client = ComputeManagementClient(credential, subscription_id)

# Specify the resource group and virtual machine name
resource_group_name = "your_resource_group_name"
vm_name = "your_vm_name"

# Specify the new size for the virtual machine
new_vm_size = "Standard_DS2_v2"

# Resize the virtual machine
compute_client.virtual_machines.begin_update(resource_group_name, vm_name, {"hardware_profile": {"vm_size": new_vm_size}})
  1. Example 3: Restart a virtual machine:
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# Authenticate using default credentials
credential = DefaultAzureCredential()

# Create a ComputeManagementClient
compute_client = ComputeManagementClient(credential, subscription_id)

# Specify the resource group and virtual machine name
resource_group_name = "your_resource_group_name"
vm_name = "your_vm_name"

# Restart the virtual machine
compute_client.virtual_machines.restart(resource_group_name, vm_name)

Please note that you need to install the required Azure SDK for Python packages (azure-identity and azure-mgmt-compute) before running these scripts.