​
More Info:

Do not disable alerts related to threat detections.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” in Azure using the Azure console, follow the below steps:
  1. Login to the Azure portal and navigate to the SQL Server that needs to be remediated.
  2. Select the SQL Server and navigate to the “Security” section.
  3. Under the “Security” section, select “Advanced Data Security”.
  4. Under the “Advanced Data Security” section, select “Threat detection settings”.
  5. In the “Threat detection settings” section, toggle the “Threat detection” button to “On”.
  6. Once the “Threat detection” button is turned on, select the “Alerts” tab.
  7. Under the “Alerts” tab, select the “Email recipients” option and add the email addresses of the recipients who should receive the alerts.
  8. Click on the “Save” button to save the changes.
  9. Once the changes are saved, the threat detection alerts will be enabled for the SQL Server, and the specified recipients will receive the alerts.
By following these steps, the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” will be remediated in Azure using the Azure console.

​

To remediate the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” in AZURE using AZURE CLI, follow the below steps:Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell.Step 2: Login to your AZURE account using the command:
az login
Step 3: Select the subscription that contains the SQL Server that you want to remediate:
az account set --subscription <subscription_id>
Step 4: Enable the Threat Detection alerts for the SQL Server using the below command:
az sql server threat-policy update --resource-group <resource_group_name> --server <sql_server_name> --state Enabled
Replace the <resource_group_name> with the name of the resource group that contains the SQL Server and <sql_server_name> with the name of the SQL Server.Step 5: Verify the Threat Detection alerts status using the below command:
az sql server threat-policy show --resource-group <resource_group_name> --server <sql_server_name>
This command will show the Threat Detection policy for the SQL Server. Verify that the state parameter is set to Enabled.Step 6: Exit the AZURE CLI using the command:
exit
With the above steps, you have successfully remediated the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” for AZURE using AZURE CLI.
To remediate the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” in Azure using Python, you can follow the below steps:Step 1: Install the Azure SDK for Python using the pip package manager. You can use the following command to install the package:
pip install azure-mgmt-sql
Step 2: Authenticate with Azure using the Azure CLI. You can use the following command to authenticate:
from azure.common.credentials import UserPassCredentials
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.sql import SqlManagementClient

subscription_id = '<your-subscription-id>'
credentials = UserPassCredentials(
    '<your-username>', '<your-password>')

resource_client = ResourceManagementClient(
    credentials, subscription_id)
sql_client = SqlManagementClient(credentials, subscription_id)
Step 3: Get the list of SQL servers in your Azure subscription. You can use the following code to get the list of SQL servers:
servers = sql_client.servers.list()
Step 4: Enable Threat Detection Alerts for each SQL server. You can use the following code to enable Threat Detection Alerts:
for server in servers:
    server_name = server.name
    resource_group_name = server.resource_group
    server_properties = sql_client.servers.get(resource_group_name, server_name)
    server_properties.security_alert_policy.state = 'Enabled'
    server_properties.security_alert_policy.email_account_admins = True
    server_properties.security_alert_policy.email_addresses = ['<your-email-address>']
    sql_client.servers.create_or_update(resource_group_name, server_name, server_properties)
In the above code, you need to replace <your-email-address> with your email address.Step 5: Verify that Threat Detection Alerts are enabled for each SQL server. You can use the following code to verify:
for server in servers:
    server_name = server.name
    resource_group_name = server.resource_group
    server_properties = sql_client.servers.get(resource_group_name, server_name)
    print(server_properties.security_alert_policy.state)
This will print the state of the Threat Detection Alerts for each SQL server.By following the above steps, you can remediate the misconfiguration “Threat Detection Alerts Disabled for SQL Servers” in Azure using Python.