Query: sql_server_auditing_enabled

with sql_server_audit_enabled as (
  select
    distinct id
  from
    azure_sql_server as s,
    jsonb_array_elements(server_audit_policy) as audit
  where
    audit -> 'properties' ->> 'state' = 'Enabled'
)
select
  'Auditing' as label,
  case when a.id is not null then 'Enabled' else 'Disabled' end as value,
  case when a.id is not null then 'ok' else 'alert' end as type
from
  azure_sql_server as s left join sql_server_audit_enabled as a on lower(s.id) = lower(a.id);