​
More Info:

Enable threat detection for all SQL Databases.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

HITRUST, SOC2, PCIDSS

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration of threat detection being disabled for SQL databases in Azure using the Azure console, follow these steps:
  1. Log in to the Azure portal and navigate to the SQL databases page.
  2. Select the SQL database for which you want to enable threat detection.
  3. In the left-hand menu, click on “Security”.
  4. Click on “Advanced Threat Protection” in the security menu.
  5. Click on “Configure advanced threat protection” to start configuring the settings.
  6. In the “Configure advanced threat protection” blade, toggle the “Advanced Threat Protection” switch to “On”.
  7. In the “Storage account” field, select the storage account where you want to store the logs.
  8. In the “Email addresses to notify” field, add the email addresses of the people who should be notified in case of a threat.
  9. In the “Send alerts to Azure Security Center” field, toggle the switch to “On” if you want to send alerts to Azure Security Center.
  10. Click on “Save” to save the settings.
Once you have followed these steps, threat detection will be enabled for the SQL database and you will be notified in case of any security threats.

​

To remediate the threat detection disabled misconfiguration for SQL Databases in Azure using Azure CLI, follow these steps:
  1. Open the Azure CLI and login to your Azure account using the command: 
    az login
  2. Once you are logged in, select the Azure subscription where your SQL database is located using the command: 
    az account set --subscription <subscription_id>
    Replace <subscription_id> with the ID of the Azure subscription where your SQL database is located.
  3. Enable threat detection for your SQL database using the command: 
    az sql db threat-policy update --resource-group <resource_group_name> --server <server_name> --database <database_name> --state Enabled
    Replace <resource_group_name> with the name of the resource group where your SQL database is located, <server_name> with the name of your SQL server, and <database_name> with the name of your SQL database.
  4. Verify that threat detection is enabled for your SQL database using the command: 
    az sql db threat-policy show --resource-group <resource_group_name> --server <server_name> --database <database_name>
    This command will display the current threat detection policy for your SQL database. Ensure that the state parameter is set to Enabled.
By following these steps, you can remediate the misconfiguration of threat detection being disabled for SQL databases in Azure using Azure CLI.
To remediate the threat detection disabled for SQL databases in Azure using Python, follow these steps:
  1. Import the necessary modules:
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.sql import SqlManagementClient
  1. Set the required variables:
subscription_id = 'your-subscription-id'
resource_group = 'your-resource-group'
server_name = 'your-server-name'
database_name = 'your-database-name'
  1. Authenticate to Azure using the Service Principal credentials:
credentials = ServicePrincipalCredentials(
    client_id = 'your-client-id',
    secret = 'your-client-secret',
    tenant = 'your-tenant-id'
)
  1. Instantiate the SQL Management Client:
sql_client = SqlManagementClient(
    credentials=credentials,
    subscription_id=subscription_id
)
  1. Enable the threat detection for the specified database:
threat_detection_policy = sql_client.databases.get_threat_detection_policy(
    resource_group_name=resource_group,
    server_name=server_name,
    database_name=database_name
)

threat_detection_policy.state = 'Enabled'

sql_client.databases.create_or_update_threat_detection_policy(
    resource_group_name=resource_group,
    server_name=server_name,
    database_name=database_name,
    parameters=threat_detection_policy
)
  1. Verify that the threat detection is enabled for the specified database:
updated_threat_detection_policy = sql_client.databases.get_threat_detection_policy(
    resource_group_name=resource_group,
    server_name=server_name,
    database_name=database_name
)

print('Threat detection is now {}'.format(updated_threat_detection_policy.state))
By following these steps, you can remediate the threat detection disabled for SQL databases misconfiguration in Azure using Python.