​
More Info:

Enable alerts related to threat detections.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

CISAZURE, CBP, HITRUST, SOC2, NISTCSF, PCIDSS

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration “Threat Detection Alerts Disabled for SQL Databases” in Azure using the Azure console, follow these steps:
  1. Log in to the Azure portal (https://portal.azure.com/).
  2. Navigate to the Azure SQL Database that has the misconfiguration.
  3. Click on the “Security” tab in the left-hand menu.
  4. Click on the “Advanced Data Security” option.
  5. Click on the “Configure advanced data security” button.
  6. In the “Advanced Data Security” blade, toggle the “Threat detection” option to “On”.
  7. Select the “Send alerts to” option and provide an email address to receive the alerts.
  8. Set the “Alerts” threshold to the desired level.
  9. Click on the “Save” button to save the changes.
Once you have completed these steps, threat detection alerts will be enabled for the Azure SQL Database and you will receive alerts when any threats are detected.

​

To remediate the misconfiguration of Threat Detection Alerts Disabled for SQL Databases in AZURE using AZURE CLI, please follow the below steps:Step 1: Open the AZURE CLI in your system.Step 2: Log in to your AZURE account using the below command:
az login
Step 3: After logging in, set the subscription where your SQL databases are located using the below command:
az account set --subscription <subscription_name>
Step 4: To enable Threat Detection Alerts for SQL databases, you need to enable the Advanced Threat Protection (ATP) service. You can enable this service by running the following command:
az sql server atp-policy update --resource-group <resource_group_name> --server <server_name> --storage-account <storage_account_name> --storage-key <storage_account_key> --workspace-resource-id <workspace_resource_id> --state Enabled
Note: Replace the placeholders with the actual values of your resource group name, server name, storage account name, storage account key, and workspace resource ID.Step 5: After enabling the ATP service, you can enable Threat Detection Alerts for your SQL databases by running the following command:
az sql db threat-policy update --resource-group <resource_group_name> --server <server_name> --database <database_name> --state Enabled
Note: Replace the placeholders with the actual values of your resource group name, server name, and database name.Step 6: Verify that the Threat Detection Alerts are enabled for your SQL databases by running the following command:
az sql db threat-policy show --resource-group <resource_group_name> --server <server_name> --database <database_name>
Note: Replace the placeholders with the actual values of your resource group name, server name, and database name.Once you follow the above steps, Threat Detection Alerts will be enabled for your SQL databases in AZURE.
To remediate the misconfiguration of threat detection alerts being disabled for SQL databases in Azure using Python, you can follow the below steps:Step 1: Import the necessary libraries and authenticate to Azure using the Azure SDK for Python.
from azure.identity import DefaultAzureCredential
from azure.mgmt.sql import SqlManagementClient
from azure.mgmt.resource import ResourceManagementClient, SubscriptionClient

credential = DefaultAzureCredential()
subscription_client = SubscriptionClient(credential)
subscription = next(subscription_client.subscriptions.list())

sql_client = SqlManagementClient(credential, subscription.subscription_id)
resource_client = ResourceManagementClient(credential, subscription.subscription_id)
Step 2: Get the resource group name and SQL server name where the database is located.
resource_group_name = "your_resource_group_name"
server_name = "your_sql_server_name"
Step 3: Get the list of SQL databases in the specified server.
database_list = sql_client.databases.list_by_server(resource_group_name, server_name)
Step 4: For each database in the list, check if the threat detection policy is enabled. If not, enable it.
for database in database_list:
    database_name = database.name
    database_resource_id = database.id
    
    # Get the current threat detection policy for the database
    threat_detection_policy = sql_client.databases.get_threat_detection_policy(resource_group_name, server_name, database_name)
    
    # Check if the threat detection policy is enabled
    if not threat_detection_policy.state == "Enabled":
        # Enable the threat detection policy
        threat_detection_policy.state = "Enabled"
        threat_detection_policy = sql_client.databases.create_or_update_threat_detection_policy(resource_group_name, server_name, database_name, threat_detection_policy)
        print(f"Threat detection policy enabled for database {database_name}")
    else:
        print(f"Threat detection policy already enabled for database {database_name}")
Step 5: Run the Python script to remediate the misconfiguration.Note: Make sure to install the necessary libraries using pip before running the script.