Query: sql_server_auditing_disabled_count

with sql_server_audit_enabled as (
  select
    distinct id
  from
    azure_sql_server as s,
    jsonb_array_elements(server_audit_policy) as audit
  where
    audit -> 'properties' ->> 'state' = 'Enabled'
)
select
  count(*) as value,
  'Auditing Disabled' as label,
  case count(*) when 0 then 'ok' else 'alert' end as type
from
 azure_sql_server where id not in (select id from sql_server_audit_enabled);