You are configuring remediation of non-compliant resources using Azure Policy. What definition effect do you need to use in order to automatically install a security extension to your virtual machine?