Control: 6.2.7 Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule
Description
Create an activity log alert for the Create or Update SQL Server Firewall Rule event.
Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.
Remediation
From Azure Portal
- Navigate to the
Monitor
blade. - Select
Alerts
. - Select
Create
. - Select
Alert rule
. - Choose a subscription.
- Select
Apply
. - Select the
Condition
tab. - Click
See all signals
. - Select
Create/Update server firewall rule (Server Firewall Rule)
. - Click
Apply
. - Select the
Actions
tab. - Click
Select action groups
to select an existing action group, orCreate action group
to create a new action group. - Follow the prompts to choose or create an action group.
- Select the
Details
tab. - Select a
Resource group
, provide anAlert rule name
and an optionalAlert rule description
. - Click
Review + create
. - Click
Create
.
From Azure CLI
az monitor activity-log alert create --resource-group "<resource group name>" --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write and level=<verbose | information | warning | error | critical> --scope "/subscriptions/<subscription ID>" --name "<activity log rule name>" --subscription <subscription id> --action-group <action group ID>
From PowerShell
Create the Conditions
object.
$conditions = @()$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Sql/servers/firewallRules/write -Field operationName$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level
Retrieve the Action Group
information and store in a variable, then create the Actions
object.
$actionGroup = Get-AzActionGroup -ResourceGroupName <resource group name> -Name <action group name>$actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id
Create the Scope
object
$scope = "/subscriptions/<subscription ID>"
Create the Activity Log Alert Rule
for Microsoft.Sql/servers/firewallRules/write
New-AzActivityLogAlert -Name "<activity log alert rule name>" -ResourceGroupName "<resource group name>" -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription <subscription ID> -Enabled $true
Default Value
By default, no monitoring alerts are created.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v300_6_2_7
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v300_6_2_7 --share
SQL
This control uses a named query:
monitor_log_alert_create_update_sql_servers_firewall_rule