​
Event Information

  • The Microsoft.Sql.servers.delete event in Azure for AzureDatabaseService refers to the deletion of a SQL server instance in Azure.
  • This event indicates that a SQL server, along with all its associated databases, has been permanently removed from the Azure environment.
  • It is important to note that this event is irreversible, and all data and configurations associated with the SQL server will be lost. Therefore, it is crucial to have proper backups and consider the implications before performing this action.

​
Examples

  1. Unauthorized deletion: If security is impacted with Microsoft.Sql.servers.delete in Azure for AzureDatabaseService, one example could be an unauthorized user gaining access to the Azure SQL server and deleting the database service. This could result in the loss of critical data and disrupt business operations.

  2. Insider threat: Another example could be an insider threat scenario where a disgruntled employee with administrative privileges intentionally deletes the Azure SQL server hosting the database service. This could lead to data loss, service downtime, and potential financial and reputational damage to the organization.

  3. Malicious activity: A third example could be a malicious actor exploiting a vulnerability in the Azure SQL server infrastructure to perform unauthorized deletions of database services. This could be achieved through techniques such as SQL injection or exploiting misconfigurations, potentially leading to data breaches and compromise of sensitive information.

​
Remediation

​
Using Console

To remediate the issues for Azure Database Service using the Azure console, you can follow these step-by-step instructions:

  1. Enable auditing for Azure SQL Database:

    • Go to the Azure portal and navigate to the Azure SQL Database service.
    • Select the specific database you want to enable auditing for.
    • In the left-hand menu, under the Security section, click on “Auditing”.
    • Click on “Enable” to enable auditing for the database.
    • Configure the desired audit settings, such as storage account, retention period, and events to audit.
    • Click on “Save” to apply the changes.

  2. Enable encryption at rest for Azure SQL Database:

    • Go to the Azure portal and navigate to the Azure SQL Database service.
    • Select the specific database you want to enable encryption for.
    • In the left-hand menu, under the Security section, click on “Transparent data encryption”.
    • Click on “Enable” to enable encryption at rest for the database.
    • Wait for the encryption process to complete, which may take some time depending on the database size.
    • Once the encryption is enabled, the status will change to “Enabled”.

  3. Enable Azure Security Center recommendations:

    • Go to the Azure portal and navigate to the Azure Security Center.
    • In the left-hand menu, click on “Recommendations”.
    • Review the list of recommendations provided by Azure Security Center for your Azure Database Service.
    • Select the specific recommendation you want to remediate.
    • Follow the provided guidance and instructions to remediate the recommendation.
    • Once the remediation steps are completed, mark the recommendation as resolved in Azure Security Center.

Note: The specific steps may vary slightly depending on the Azure portal version and interface changes. Always refer to the official Azure documentation for the most up-to-date instructions.

​
Using CLI

To remediate issues related to Azure Database Service using Azure CLI, you can follow these steps:

  1. Enable auditing for Azure SQL Database:

    • Use the az sql server update-auditing command to enable auditing for the Azure SQL Server.
    • Specify the necessary parameters such as --state Enabled and --storage-account-resource-id to configure auditing settings.
    • Example command: az sql server update-auditing --resource-group <resource-group-name> --server <server-name> --state Enabled --storage-account-resource-id <storage-account-resource-id>

  2. Enable diagnostic settings for Azure SQL Database:

    • Use the az monitor diagnostic-settings create command to enable diagnostic settings for the Azure SQL Database.
    • Specify the necessary parameters such as --name, --resource-id, and --workspace to configure diagnostic settings.
    • Example command: az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <database-resource-id> --workspace <workspace-id>

  3. Enable threat detection for Azure SQL Database:

    • Use the az sql db threat-policy update command to enable threat detection for the Azure SQL Database.
    • Specify the necessary parameters such as --name, --resource-group, --server, and --state to configure threat detection settings.
    • Example command: az sql db threat-policy update --name <database-name> --resource-group <resource-group-name> --server <server-name> --state Enabled

​
Using Python

To remediate issues related to Azure Database Service using Python, you can follow these steps:

  1. Monitor and alert on database service events:

    • Use the Azure Monitor service to set up alerts for specific events or metrics related to the Azure Database Service.
    • Create a Log Analytics workspace and configure it to collect and analyze logs from the database service.
    • Use the Azure Monitor Python SDK to programmatically create and manage alerts and log analytics queries.

  2. Implement automated backups and retention policies:

    • Use the Azure Backup service to schedule automated backups for your Azure Database Service.
    • Configure the retention policies to retain backups for a specific duration.
    • Utilize the Azure Python SDK to programmatically create and manage backup policies and retention settings.

  3. Implement security best practices:

    • Enable firewall rules to restrict access to your Azure Database Service.
    • Implement Azure Active Directory authentication for better security.
    • Utilize the Azure Key Vault service to securely store and manage database connection strings and credentials.
    • Use the Azure Python SDK to automate the configuration of firewall rules, enable Azure AD authentication, and interact with Azure Key Vault.

Please note that the provided steps are high-level guidelines, and the actual implementation may vary based on your specific requirements and the Azure Database Service you are using.