rules/findings/azure/databases/azure_sql/azure-sql-auditing-retention.json
|
{
"provider": "Azure", "serviceType": "SQL Database", "serviceName": "Databases", "displayName": "Ensure that \u0027Auditing\u0027 Retention is \u0027greater than _ARG_0_ days\u0027", "description": "SQL Server Audit Retention should be configured to be greater than _ARG_0_ days.", "rationale": "Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access.", "impact": "", "remediation": { "text": "\n\t\t\t##### Remediate From Azure Portal \n\t\t\t1. Go to SQL servers \n\t\t\t2. For each server instance \n\t\t\t3. Click on Auditing \n\t\t\t4. If storage is selected, expand Advanced properties \n\t\t\t5. Set the Retention (days) setting greater than 90 days or 0 for unlimited retention. \n\t\t\t6. Select Save\n\t\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql", "https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-6-configure-log-storage-retention" ], "compliance": [ { "name": "CIS Microsoft Azure Database Services", "version": "2.0.0", "reference": "9.7", "profile": [ "Level 1" ] } ], "level": "medium", "tags": [], "rule": { "path": "az_sql_servers", "subPath": null, "selectCondition": {}, "query": [ { "filter": [ { "conditions": [ [ "eq", "auditing.retentionDays" ], [ "auditing.retentionDays", "lt", "_ARG_0_" ], [ "auditing.retentionDays", "eq", "-1" ], [ "auditing.enabled", "eq", "Disabled" ] ], "operator": "or" } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "name": "Server Name", "location": "Location", "resourceGroupName": "Resource group name", "fqdn": "FQDN", "auditing.retentionDays": "Auditing policy state" }, "expandObject": null }, "table": "default", "decorate": [], "emphasis": [], "actions": { "objectData": { "properties": [ "id", "name", "location", "auditing" ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "name": "Server Name", "location": "Location", "resourceGroupName": "Resource group name", "fqdn": "FQDN", "auditing.retentionDays": "Auditing policy state" }, "expandObject": null }, "status": { "keyName": [ "name" ], "message": "Ensure that \u0027Auditing\u0027 Retention is \u0027greater than _ARG_0_ days\u0027 for {name}", "defaultMessage": null }, "properties": { "resourceName": "name", "resourceId": "id", "resourceType": "type" }, "onlyStatus": false } }, "idSuffix": "azure_sql_auditing_retention_not_compliant", "notes": [], "categories": [], "immutableProperties": [ "name", "id" ], "id": "aure_sql_007" } |