Short Threat Detection Retention Period for SQL Servers
More Info:
Threat detection retention period should be greater than defined days. Default 90 days.Risk Level
MediumAddress
Reliability, SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
The short threat detection retention period for SQL Servers in Azure can leave you vulnerable to security threats. Here are the steps to remediate it using the Azure console:
- Open the Azure portal and navigate to the SQL Server that you want to remediate.
- In the left-hand menu, click on “Advanced Threat Protection”.
- In the “Advanced Threat Protection” blade, click on “Settings” at the top.
- Under “Data retention”, select the desired retention period. Microsoft recommends a retention period of at least 90 days.
- Click “Save” to apply the changes.
- Once the retention period is set, you can configure alerts and view threat detection reports to monitor your SQL Server for potential security threats.
Using CLI
Using CLI
The remediation steps for this misconfiguration in Azure using Azure CLI are as follows:This command will show the current threat detection policy for the SQL server, including the retention period.By following these steps, you can increase the threat detection retention period for a SQL server in Azure using Azure CLI.
- Open Azure CLI and login to your Azure account.
- Run the following command to get a list of all the SQL servers in your Azure account:
- Identify the SQL server for which you want to increase the threat detection retention period and note down its resource group and name.
- Run the following command to set the threat detection retention period for the SQL server to 90 days (you can adjust the retention period as per your requirement):
- Verify that the retention period has been updated by running the following command:
Using Python
Using Python
The threat detection retention period for SQL servers in Azure is set to a default of 90 days. This means that any log data older than 90 days is automatically deleted. To remediate this, you can use the Azure Python SDK to update the retention period to a longer duration. Here are the steps to follow:In this code, we are updating the retention period to 365 days. You can adjust this value to your desired duration.
- Install the Azure Python SDK using pip:
- Authenticate to your Azure account using the SDK. You can use the following code to authenticate using a service principal:
- Connect to the Azure Monitor API using the SDK:
- Retrieve the current diagnostic settings for the SQL server:
- Update the retention period for the SQL server:
- Run the Python script to update the retention period for your SQL server in Azure.