Control: 4.2.1 Ensure that Advanced Threat Protection (ATP) on a SQL server is set to 'Enabled'
Description
It is recommended to enable Azure Defender for SQL on critical SQL Servers. Azure Defender for SQL is a unified package for advanced security capabilities.
It is available for Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics. It includes functionality for discovering and classifying sensitive data, surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database. It provides a single go-to location for enabling and managing these capabilities.
Default setting for Azure Defender for SQL is Off.
Remediation
From Console
- Login to Azure console and navigate to SQL Servers.
- For each server instance, go to Security section from left pane.
- Click on
Security Center. - Click
Enable Azure Defender for SQL.
From PowerShell
Set-AzSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -EmailAdmins $True
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v140_4_2_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v140_4_2_1 --shareSQL
This control uses a named query:
sql_server_atp_enabled