Control: Auditing on SQL server should be enabled
Description
Auditing on your SQL Server should be enabled to track database activities across all databases on the server and save them in an audit log.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.sql_server_auditing_onSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.sql_server_auditing_on --shareSQL
This control uses a named query:
select s.id as resource, case when audit -> 'properties' ->> 'state' = 'Disabled' then 'alarm' else 'ok' end as status, case when audit -> 'properties' ->> 'state' = 'Disabled' then name || ' auditing disabled.' else name || ' auditing enabled.' end as reason , s.resource_group as resource_group , sub.display_name as subscriptionfrom azure_sql_server s, jsonb_array_elements(server_audit_policy) audit, azure_subscription subwhere sub.subscription_id = s.subscription_id;