````plaintext
## Bicep Template for FRR-VDR (Vulnerability Detection and Response)

```bicep
// frr_vdr.bicep - Vulnerability Management Infrastructure
// Implements FRR-VDR family requirements for vulnerability detection,
// patch management, remediation tracking, and compliance reporting
//
// FRR-VDR Requirements Supported:
// - FRR-VDR-01 through VDR-16: Core vulnerability detection and response
// - FRR-VDR-AC-01 to AC-02: Authenticated vulnerability scanning
// - FRR-VDR-EX-01: Deviation tracking and exception management
// - FRR-VDR-RP-01 to RP-03: Agency-specific vulnerability reporting
// - FRR-VDR-TF-01 to TF-02: Remediation timeframes and KEV tracking
//
// Related KSIs:
// - KSI-AFR-01: Asset discovery and inventory
// - KSI-AFR-04: Vulnerability detection and remediation
// - KSI-CED-01: Continuous evidence collection

targetScope = 'resourceGroup'

param location string = resourceGroup().location
param workspaceName string = 'vdr-compliance-${uniqueString(resourceGroup().id)}'
param storageAccountName string = 'vdrevidence${uniqueString(resourceGroup().id)}'
param defenderEnabled bool = true

// Log Analytics Workspace for vulnerability scan logs
// Retention: 730 days (FedRAMP 20x requirement)
resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: workspaceName
  location: location
  properties: {
    sku: {
      name: 'PerGB2018'
    }
    retentionInDays: 730  // MANDATORY: FedRAMP 20x requires 2-year retention
    features: {
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
  }
}

// Storage Account for vulnerability reports and evidence
// Supports: FRR-VDR evidence storage, FRR-ADS machine-readable reports
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_GRS'  // Geo-redundant for compliance evidence
  }
  kind: 'StorageV2'
  properties: {
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    allowBlobPublicAccess: false
    networkAcls: {
      defaultAction: 'Deny'
      bypass: 'AzureServices'
    }
    encryption: {
      requireInfrastructureEncryption: true
      services: {
        blob: {
          enabled: true
          keyType: 'Account'
        }
      }
      keySource: 'Microsoft.Storage'  // Use Customer-Managed Keys in production
    }
  }
}

// Blob Container for vulnerability scan results
// Supports: FRR-VDR-01 (scan results), FRR-ADS-01 (machine-readable evidence)
resource scanResultsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/vulnerability-scans'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-VDR vulnerability scan results'
      retention: '7 years'
    }
  }
}

// Blob Container for remediation tracking
// Supports: FRR-VDR-TF-01 (remediation timeframes)
resource remediationContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/remediation-tracking'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-VDR remediation timeframe tracking'
      retention: '3 years'
    }
  }
}

// Blob Container for deviation approvals
// Supports: FRR-VDR-EX-01 (exception management)
resource deviationsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  name: '${storageAccount.name}/default/vulnerability-deviations'
  properties: {
    publicAccess: 'None'
    metadata: {
      purpose: 'FRR-VDR-EX deviation approvals and documentation'
      retention: '7 years'
    }
  }
}

// Action Group for vulnerability alerts
// Supports: FRR-VDR-01 (alerting), FRR-VDR-TF-01 (deadline alerts)
resource actionGroup 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: 'vdr-compliance-alerts'
  location: 'global'
  properties: {
    groupShortName: 'VDRAlerts'
    enabled: true
    emailReceivers: [
      {
        name: 'Security Team'
        emailAddress: 'security@contoso.com'
        useCommonAlertSchema: true
      }
      {
        name: 'Compliance Team'
        emailAddress: 'compliance@contoso.com'
        useCommonAlertSchema: true
      }
    ]
  }
}

// Alert Rule: Critical vulnerabilities exceeding remediation timeframe
// Supports: FRR-VDR-TF-01 (15-day critical, 30-day high remediation)
resource criticalVulnAlert 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = {
  name: 'critical-vuln-overdue'
  location: location
  properties: {
    displayName: 'Critical Vulnerabilities Overdue for Remediation'
    description: 'Alerts when critical vulnerabilities exceed 15-day remediation timeframe (FRR-VDR-TF-01)'
    severity: 0  // Critical
    enabled: true
    evaluationFrequency: 'PT1H'
    scopes: [
      logAnalytics.id
    ]
    windowSize: 'P1D'
    criteria: {
      allOf: [
        {
          query: '''
            SecurityVulnerability
            | where Severity == "Critical"
            | where RemediationDeadline < now()
            | summarize Count = count() by VulnerabilityId, AffectedResource
          '''
          timeAggregation: 'Count'
          operator: 'GreaterThan'
          threshold: 0
          failingPeriods: {
            numberOfEvaluationPeriods: 1
            minFailingPeriodsToAlert: 1
          }
        }
      ]
    }
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
  }
}

// Microsoft Defender for Cloud configuration (optional but recommended)
// Supports: FRR-VDR-01 (vulnerability scanning), KSI-AFR-04
resource defenderForServers 'Microsoft.Security/pricings@2024-01-01' = if (defenderEnabled) {
  name: 'VirtualMachines'
  properties: {
    pricingTier: 'Standard'
    subPlan: 'P2'
  }
}

resource defenderForContainers 'Microsoft.Security/pricings@2024-01-01' = if (defenderEnabled) {
  name: 'Containers'
  properties: {
    pricingTier: 'Standard'
  }
}

// Automation Account for scheduled vulnerability reporting
// Supports: FRR-VDR-RP-01 (agency-specific reports), FRR-VDR-TF-01 (monthly KEV reports)
resource automationAccount 'Microsoft.Automation/automationAccounts@2023-11-01' = {
  name: 'vdr-automation-${uniqueString(resourceGroup().id)}'
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    sku: {
      name: 'Basic'
    }
    encryption: {
      keySource: 'Microsoft.Automation'
    }
  }
}

// Outputs for integration with CI/CD and evidence collection
output workspaceId string = logAnalytics.id
output workspaceCustomerId string = logAnalytics.properties.customerId
output storageAccountName string = storageAccount.name
output scanResultsContainerUrl string = '${storageAccount.properties.primaryEndpoints.blob}vulnerability-scans'
output remediationContainerUrl string = '${storageAccount.properties.primaryEndpoints.blob}remediation-tracking'
output automationAccountName string = automationAccount.name
```

## Deployment Instructions

1. **Create Resource Group:**
   ```bash
   az group create --name rg-vdr-compliance --location eastus
   ```

2. **Deploy Template:**
   ```bash
   az deployment group create \
     --resource-group rg-vdr-compliance \
     --template-file frr_vdr.bicep \
     --parameters defenderEnabled=true
   ```

3. **Configure Vulnerability Scanning:**
   - Enable Defender for Cloud vulnerability assessments
   - Integrate with Trivy, Qualys, or Tenable for authenticated scanning
   - Configure CI/CD pipeline to upload scan results to blob storage

4. **Set Up Evidence Collection:**
   - Create Azure Function to collect daily scan results
   - Store results in `vulnerability-scans` container
   - Generate monthly reports for FRR-VDR-TF-01 (KEV tracking)

5. **Configure Remediation Tracking:**
   - Set up automated tracking for vulnerability remediation
   - Calculate remediation deadlines: Critical=15 days, High=30 days, Moderate=90 days
   - Alert when deadlines are approaching or exceeded

## Evidence Artifacts (FRR-ADS)

**Machine-Readable Formats:**
- `vulnerability-scans/YYYY-MM-DD-scan-results.json` - Daily scan results
- `remediation-tracking/YYYY-MM-DD-remediation-status.json` - Remediation progress
- `vulnerability-deviations/YYYY-MM-DD-exceptions.json` - Approved exceptions

**Collection Schedule:**
- Vulnerability scans: Daily (automated in CI/CD)
- Remediation status: Weekly
- KEV tracking report: Monthly (FRR-VDR-TF-01)
- Deviation reviews: Quarterly

## Related FRR Requirements

- **FRR-VDR-01**: Vulnerability scanning implementation ✓
- **FRR-VDR-08**: Patch management procedures (requires process documentation)
- **FRR-VDR-11**: Deviation tracking and approvals ✓
- **FRR-VDR-AC-01**: Authenticated scanning (configure scanner credentials)
- **FRR-VDR-TF-01**: Remediation timeframes and KEV tracking ✓
- **FRR-VDR-TF-02**: KEV vulnerability prioritization ✓
- **FRR-VDR-RP-01**: Agency-specific vulnerability reporting ✓
````
