# Azure CSPM - Multiple questions
**URL:** https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534
**Category:** Elastic Security
**Created:** [March 16, 2024, 8:58am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534 "2024-03-16T08:58:48Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [March 16, 2024, 8:58am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/1 "2024-03-16T08:58:48Z")
Hello,
So I just enabled Azure CSPM (8.12.2) and I have some questions:
- Is there is a way to snooze / acknowledge / ignore findings? Some of the findings are not applicable to our organization and we would like to ignore them or acknowledge them.
- Where is the compliance score stored? Or is it a calculated value? I would like to show this score on a custom dashboard we use for reporting to our management. How can I create a Lens metric visualisation which show this score?
- Is there a way to visualize the evolution of the compliance score? If we'd fix some things, I'd like to show to my management the evolution of our compliance score somehow.
- Is it documented somewhere what Azure ur'ls need to be acessible so I can open only those in our perimeter firewall? For example what url's in this list do I need to open? [Allow the Azure portal URLs on your firewall or proxy server - Azure portal | Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-portal/azure-portal-safelist-urls?tabs=public-cloud)
Thanks.
Willem
---
### Author:  [@smriti0321](https://discuss.elastic.co/u/smriti0321)
#### Post date: [March 19, 2024, 8:25pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/3 "2024-03-19T20:25:18Z")
@willemdh Thank you for your questions and exploring latest Azure CSPM coverage in our Product. Please find responses below:
- Is there is a way to snooze / acknowledge / ignore findings? Some of the findings are not applicable to our organization and we would like to ignore them or acknowledge them.
> It was one of the top asks from customers and we have prioritised and worked on delivering this capability in version 8.13 which will be released later this month. We plan to release the "enable/disable" functionality for benchmark rules. It will be possible to disable/mute specific rules so they are not producing any findings and don't participate in the score calculation. Lookout for 8.13 release updates.
- Where is the compliance score stored? Or is it a calculated value? I would like to show this score on a custom dashboard we use for reporting to our management. How can I create a Lens metric visualisation which show this score?
> The percentage score is a calculated value, but all the base numbers for the score are stored in the index `logs-cloud_security_posture.scores-default` and it should be possible to use it in Lens. You need to create a Data View with this index first so it shows up in Lens, but then you should be able to build any custom visualisation based on this data
- Is there a way to visualize the evolution of the compliance score? If we'd fix some things, I'd like to show to my management the evolution of our compliance score somehow.
> Should be possible with a custom visualisation. The score data is stored in the `logs-cloud_security_posture.scores-default` index every 5 mins, so it is possible to show a trendline of the score
Is it documented somewhere what Azure ur'ls need to be acessible so I can open only those in our perimeter firewall? For example what url's in this list do I need to open?
> We recommend to enable all listed endpoints in Microsoft's documentation.
Let me know if you have any follow up questions on these or related topics.
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [March 19, 2024, 9:03pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/4 "2024-03-19T21:03:58Z")
Thank you very much for all the info. I'll look into the scores indices and will look for the compliance score.
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 8, 2024, 1:53pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/5 "2024-04-08T13:53:47Z")
@smriti0321 Are you sure I should be able to recreate the percentage score? I gave it a try, but the low / medium / high / critical scores always seem 0...
The index also only has very limited fields:
So not sure what's going on here and where else I should look.
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 18, 2024, 8:37am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/6 "2024-04-18T08:37:36Z")
hi @willemdh, on the screenshot I see that you are looking at documents with `policy_template: vuln_mgmt`. The index `logs-cloud_security_posture.scores-default` contains scores from all our integrations CSPM, KSPM, and CNVM. Here is how you can distinguish them:
CSPM: `policy_template: cspm`
KSPM: `policy_template: kspm`
CNVM: `policy_template: vuln_mgmt`
As you mentioned that you installed CSPM Azure, look for documents with `policy_template: cspm`. Mind that they have a different structure than the vuln\_mgmt ones so that you won't have critical, high, etc. attributes on them, but there should be other attributes you can use for your usecase, eg. failed\_findings and passed\_findings
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 18, 2024, 6:06pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/7 "2024-04-18T18:06:54Z")
Hi @maxcold ,
I can assure you I have no data with:
`policy_template: cspm`
in `logs-cloud_security_posture.scores-*`
Willem
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 18, 2024, 8:07pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/8 "2024-04-18T20:07:57Z")
Do you see any data in the Security \> Dashboards \> Cloud Security Posture, the URL should be `/app/security/cloud_security_posture/dashboard/cspm` ? Do you see any findings in the Security \> Findings \> Misconfigurations?
The stats for the indices you see in Stack Management \> Index Managements \> Indecies when you search for `logs-cloud_security_posture` in the search bar would also be helpful
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 19, 2024, 6:17am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/9 "2024-04-19T06:17:49Z")
> [@maxcold](#):
>
> /app/security/cloud\_security\_posture/dashboard/cspm
Yes, the CSPM found misconfigurations.
```auto
health status index uuid pri rep docs.count docs.deleted creation.date.string store.size pri.store.size
green open .ds-logs-cloud_security_posture.findings-default-2024.03.15-000001 ex-rujcBRr-6biMof8YEsQ 1 1 19077 0 2024-03-15T15:23:21.955Z 65.2mb 32.6mb
green open .ds-logs-cloud_security_posture.findings-default-2024.04.14-000002 0dwgNQDkRVedn5UkvcOcMA 1 1 5841 0 2024-04-14T15:24:23.705Z 21.1mb 10.5mb
green open logs-cloud_security_posture.findings_latest-default TBa-oWEXTZarG8pTkLCb4w 1 1 531 0 2024-03-14T15:23:09.353Z 1.9mb 1007kb
green open logs-cloud_security_posture.scores-default VEGDQvXWTFm9zfHvuqMPNg 1 1 10164 0 2024-03-14T15:23:09.682Z 1.2mb 648.9kb
green open logs-cloud_security_posture.vulnerabilities_latest-default BtbkSROYT5WkziDp2u7pMA 1 1 0 0 2024-03-14T15:23:10.012Z 498b 249b
```
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 19, 2024, 8:39am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/10 "2024-04-19T08:39:58Z")
Thanks for providing more information! I'm assuming you also have data in the Compliance Score, trendline, and the split between failed and passed findings. this data is based on the `policy_template: cspm` documents in `logs-cloud_security_posture.scores-default`, unless I'm missing smth obvious.
You can try doing the following request in the Dev Tools of Kibana (search for Dev Tools in the global Kibana search)
```auto
POST /logs-cloud_security_posture.scores-default/_search
{
"size": 1,
"query": {
"term": {
"policy_template": {
"value": "cspm"
}
}
}
}
```
And see if it returns one document
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 19, 2024, 9:43am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/11 "2024-04-19T09:43:36Z")
Yes we are seeing the compliance score and failed and passed findings.
The query doesn't give any results:
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 21, 2024, 10:13am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/12 "2024-04-21T10:13:26Z")
This is interesting, I'm out of obvious ideas. It seems it requires a more thorough investigation, I'll get back to you after I do some digging myself into why it can happen that you don't see documents in `logs-cloud_security_posture.scores-default` index while the CSPM dashboard works fine.
In the meantime, you can also check if you have any special setup around access control (in Users and Roles) and look in more detail into the documents of `logs-cloud_security_posture.scores-default`, what `policy_template` values you have there on the documents and you can spot smth off with this index in the Index Management
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 22, 2024, 4:41pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/13 "2024-04-22T16:41:19Z")
@willemdh one more thing I want to check, do you see the trendlines in the CSP dashboard? Or do you see "No data to display" message instead of trendlines? Here is how the trendline chart should look like
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 22, 2024, 4:59pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/14 "2024-04-22T16:59:18Z")
Hey @maxcold
Indeed I see "No data to display"
I can see all data in this cluster, so it shouldn't be a privilege issue.
The indices in Index Management:
I only see policy\_template "vuln\_mgmt" in the scores index.
Willem
---
### Author:  [@maxcold](https://discuss.elastic.co/u/maxcold)
#### Post date: [April 23, 2024, 8:35am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/15 "2024-04-23T08:35:17Z")
@willemdh thanks for your patience and for providing all this information! You seem to hit a bug which we fixed in 8.13. We are working on a fix for 8.12, it should be a part of an integration version update, not the stack update when implemented. We will keep you posted on the progress. The bug leads to no CSPM data being stored in the scores index, therefore you only see the current posture, but not the history and trendline.
---
### Author:  [@Paulo\_Henrique](https://discuss.elastic.co/u/Paulo_Henrique)
#### Post date: [April 23, 2024, 11:41pm UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/16 "2024-04-23T23:41:19Z")
Hi @willemdh
As mentioned by @maxcold, we worked on backporting the fix for Kibana 8.12, a fix was [patched](https://github.com/elastic/integrations/pull/9668) today, and the only step to apply the fix is to upgrade the Security Posture Management integration to v1.7.5.
You can refer to [this](https://www.elastic.co/guide/en/fleet/current/upgrade-integration.html) documentation about how to upgrade an integration in case it was not set for automatic upgrades.
Once the Security Posture Management integration is upgraded to version 1.7.5 the Dashboard should be fixed the next time the elastic agent sends the Azure findings data.
Once again, thank you for providing all the information and exploring Azure CSPM coverage in Elastic.
Let us know if you have any other questions
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 24, 2024, 8:34am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/17 "2024-04-24T08:34:39Z")
Hi @maxcold @Paulo_Henrique
So weird, I didn't update CSPM Integration, but now it is on 1.7.5 and we have a trendline now. So is this the only integration which is automatically updated?
Anyway, thanks for the fix.
Just an fyi, we have another CSPM related issue where superusers can see the findings in all Spaces, but our cloud engineers can only see it in the default Space (to which they do not have all access too). This is not very logical. See support case 01585364 and enhancement request 21439.
Willem
---
### Author:  [@willemdh](https://discuss.elastic.co/u/willemdh)
#### Post date: [April 25, 2024, 11:05am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/18 "2024-04-25T11:05:05Z")
So for future reference, this is what I needed to visualise the score in a Lens Metric formula
`last_value(passed_findings, kql='"passed_findings": *') / last_value(total_findings, kql='"total_findings": *')`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 23, 2024, 11:05am UTC](https://discuss.elastic.co/t/azure-cspm-multiple-questions/355534/19 "2024-05-23T11:05:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.