​
More Info:

Enable SQL Encryption recommendations for virtual machines.

​
Risk Level

Low

​
Address

Security, Operational Maturity

​
Compliance Standards

HIPAA

​
Triage and Remediation

​
Remediation

Using Console

To remediate the “Monitor SQL Encryption setting is not enabled” misconfiguration in AZURE using the AZURE console, follow the below steps:
  1. Login to the AZURE portal (https://portal.azure.com/).
  2. Navigate to the “SQL servers” option from the left navigation pane.
  3. Select the SQL server for which you want to enable the encryption setting.
  4. Click on the “Security” option from the left navigation pane.
  5. Select the “Auditing & Threat detection” option.
  6. Click on the “Advanced Threat Protection” option.
  7. Scroll down to the “SQL Advanced Threat Protection” section.
  8. Click on the “Edit” button.
  9. Enable the “Monitor SQL Encryption setting” option.
  10. Click on the “Save” button to save the changes.
Once the above steps are completed, the “Monitor SQL Encryption setting is not enabled” misconfiguration will be remediated in AZURE.

​

To remediate the “Monitor SQL Encryption setting is not enabled” misconfiguration in Azure using Azure CLI, follow the below steps:Step 1: Open Azure CLI and login to your Azure account using the command:
az login
Step 2: Once you are logged in, set the Azure subscription where your SQL Server is located using the command:
az account set --subscription <subscription_id>
Step 3: Check if the SQL Encryption setting is enabled or not using the command:
az sql server tde show --resource-group <resource_group_name> --server <sql_server_name> --database <database_name>
Step 4: If the SQL Encryption setting is not enabled, enable it using the command:
az sql server tde set --status Enabled --resource-group <resource_group_name> --server <sql_server_name> --database <database_name>
Step 5: Verify that the SQL Encryption setting is enabled by running the command in Step 3 again.By following these steps, you can remediate the “Monitor SQL Encryption setting is not enabled” misconfiguration in Azure using Azure CLI.
To remediate the “Monitor SQL Encryption setting is not enabled” misconfiguration in Azure using Python, you can follow the below steps:
  1. Import the necessary libraries:
from azure.identity import DefaultAzureCredential
from azure.mgmt.security import SecurityCenter
  1. Authenticate to Azure using the DefaultAzureCredential class:
credential = DefaultAzureCredential()
  1. Instantiate the SecurityCenter client using the credential:
security_center_client = SecurityCenter(
    credential=credential,
    subscription_id="<subscription_id>"
)
  1. Get the security policy for SQL encryption:
policy = security_center_client.security_policies.get(
    resource_group_name="<resource_group_name>",
    security_policy_name="<security_policy_name>"
)

sql_encryption_setting = next(
    (setting for setting in policy.settings if setting.name == "sqlEncryption"),
    None
)
  1. If the sqlEncryption setting is not enabled, enable it and update the security policy:
if sql_encryption_setting and not sql_encryption_setting.value:
    sql_encryption_setting.value = True
    policy = security_center_client.security_policies.create_or_update(
        resource_group_name="<resource_group_name>",
        security_policy_name="<security_policy_name>",
        security_policy=policy
    )
The above steps will remediate the “Monitor SQL Encryption setting is not enabled” misconfiguration in Azure using Python.