Auditing Disabled for SQL Databases
More Info:
Enable auditing for all SQL Databases.Risk Level
MediumAddress
Security, Operational MaturityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of auditing disabled for SQL databases in Azure, you can follow the below steps:
- Open the Azure portal and go to the SQL database that needs to be remediated.
- In the left-hand menu, select “Auditing and Threat Detection”.
- In the “Auditing and Threat Detection” blade, select “Audit logs”.
- In the “Audit logs” blade, click on the “Turn on auditing” button.
- In the “Audit logs” blade, select the storage account where the audit logs will be stored.
- Click on “Save” to enable auditing for the SQL database.
- In the “Auditing and Threat Detection” blade, select “Threat Detection”.
- In the “Threat Detection” blade, click on “Enable Threat Detection”.
- In the “Threat Detection” blade, select the storage account where the threat detection logs will be stored.
- Click on “Save” to enable threat detection for the SQL database.
Using CLI
Using CLI
To remediate the “Auditing Disabled for SQL Databases” misconfiguration in Azure using Azure CLI, follow these steps:Note: Replace the placeholders with actual values for storage account name, storage account key, storage account endpoint, retention period, resource group name, and SQL server name.This command will display the current audit policy for the SQL server and its databases.
- Open Azure CLI and login to your Azure account using the command:
- Once you are logged in, set the default subscription where your SQL databases are located using the command:
- Enable auditing for the SQL server by running the following command:
- Once the command is executed successfully, auditing will be enabled for the SQL server and all the databases under it.
- Verify the status of auditing by running the following command:
- Repeat the above steps for all the SQL servers in your Azure environment to ensure that auditing is enabled for all the databases.
Using Python
Using Python
To remediate the issue of auditing disabled for SQL databases in Azure, you can use the following Python code:This code will iterate through all the SQL servers in your subscription, and for each server, it will enable auditing for all the databases and set Azure Monitor as the target. This will remediate the issue of auditing disabled for SQL databases in Azure.
- First, import the necessary libraries:
- Next, authenticate and create a SQL management client object:
- Get the list of SQL servers in your subscription:
- For each server, get the list of databases and enable auditing for each database: