​
More Info:

Specify email addresses and ensure that alerts are sent to them.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

​
Triage and Remediation

​
Remediation

Using Console

To remediate the “Threat Detection Alerts Disabled for SQL Databases” misconfiguration in Azure, you can follow these steps:
  1. Log in to the Azure portal and navigate to the SQL database that has the threat detection alerts disabled.
  2. Click on the “Security” tab in the left-hand menu.
  3. Under the “Threat detection” section, click on the “Advanced Threat Protection settings” link.
  4. In the “Advanced Threat Protection settings” window, click on the “SQL Advanced Threat Protection” tab.
  5. Click on the “Configure advanced threat protection” button.
  6. In the “Configure advanced threat protection” window, select the checkbox next to “Enable SQL advanced threat protection”.
  7. Choose the storage account where you want to store the alerts. If you don’t have a storage account, you can create a new one by clicking on the “Create new” button.
  8. Click on the “Save” button to enable the threat detection alerts for the SQL database.
  9. You can also configure the alert policy settings by clicking on the “Alert policies” tab in the “Advanced Threat Protection settings” window.
  10. In the “Alert policies” tab, you can configure the severity level, email notification, and other settings for the threat detection alerts.
  11. Click on the “Save” button to save the alert policy settings.
With these steps, you have successfully remediated the “Threat Detection Alerts Disabled for SQL Databases” misconfiguration in Azure.

​

The following are the step-by-step instructions to remediate the “Threat Detection Alerts Disabled for SQL Databases” misconfiguration in Azure using Azure CLI:
  1. Open the Azure CLI on your local machine or in the Azure portal.
  2. Login to your Azure account using the following command: 
    az login
  3. Once you are logged in, set the subscription that you want to work with: 
    az account set --subscription <subscription_id>
  4. Check the current status of the Threat Detection Alerts for the SQL Database using the following command: 
    az sql db threat-policy show --resource-group <resource_group_name> --server <server_name> --database <database_name>
  5. If the Threat Detection Alerts are disabled, enable them using the following command: 
    az sql db threat-policy update --state Enabled --email-address <email_address> --retention-day 30 --resource-group <resource_group_name> --server <server_name> --database <database_name>
    Note: Replace <email_address> with the email address where you want to receive the alerts.
  6. Verify that the Threat Detection Alerts are enabled by running the following command: 
    az sql db threat-policy show --resource-group <resource_group_name> --server <server_name> --database <database_name>
    This command should return the current status of the Threat Detection Alerts for the SQL Database.
By following the above steps, you can remediate the “Threat Detection Alerts Disabled for SQL Databases” misconfiguration in Azure using Azure CLI.
To remediate the “Threat Detection Alerts Disabled for SQL Databases” misconfiguration in Azure using Python, you can use the Azure SDK for Python and follow these steps:
  1. Install the Azure SDK for Python using pip: 
    pip install azure-mgmt-resource azure-mgmt-sql
  2. Authenticate with Azure using your credentials: 
    from azure.identity import DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.sql import SqlManagementClient

credential = DefaultAzureCredential()
subscription_id = '<your-subscription-id>'

resource_client = ResourceManagementClient(credential, subscription_id)
sql_client = SqlManagementClient(credential, subscription_id)
  3. Get a list of all SQL servers in your subscription: 
    sql_servers = sql_client.servers.list_by_subscription()

for server in sql_servers:
    server_name = server.name
    server_resource_group = server.resource_group
  4. For each SQL server, check if Threat Detection is enabled: 
    for server in sql_servers:
    server_name = server.name
    server_resource_group = server.resource_group

    server_details = sql_client.servers.get(server_resource_group, server_name)
    threat_detection_enabled = server_details.security_policy.security_alert_policy.state == 'Enabled'
  5. If Threat Detection is not enabled, enable it: 
    from azure.mgmt.sql.models import SecurityAlertPolicy, ServerSecurityAlertPolicy

if not threat_detection_enabled:
    # Create a new security alert policy with Threat Detection enabled
    security_alert_policy = SecurityAlertPolicy(
        state='Enabled',
        disabled_alerts=[],
        email_account_admins=True,
        email_addresses=[],
        retention_days=30,
        storage_account_access_key='<your-storage-account-access-key>',
        storage_endpoint='<your-storage-account-endpoint>'
    )

    server_security_alert_policy = ServerSecurityAlertPolicy(security_alert_policy=security_alert_policy)

    # Update the server with the new security alert policy
    sql_client.servers.create_or_update_security_alert_policy(server_resource_group, server_name, server_security_alert_policy)
  6. Run the script periodically to ensure that Threat Detection remains enabled for all SQL servers in your subscription.
Note: Replace <your-subscription-id>, <your-storage-account-access-key>, and <your-storage-account-endpoint> with your own values.