Azure Audit Securitycenter Defender Enabled For SQL Server

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate the misconfiguration of enabling Microsoft Defender for Cloud for SQL Server Virtual Machines in Azure using the Azure console:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the virtual machine that hosts the SQL Server instance that you want to protect with Microsoft Defender for Cloud.
Click on the "Networking" option in the left-hand menu.
Select the "Network Security Group" associated with the virtual machine.
Click on the "Inbound security rules" option.
Click on the "Add" button to create a new inbound security rule.
In the "Add inbound security rule" pane, enter the following details:
- Name: Enter a name for the rule (e.g., "Microsoft Defender for Cloud - SQL Server VM").
- Priority: Enter a priority for the rule (e.g., "100").
- Source: Select "Any" to allow traffic from any source IP address.
- Source port ranges: Leave this field blank.
- Destination: Select "VirtualNetwork" to allow traffic to the virtual network that contains the SQL Server VM.
- Destination port ranges: Enter "1433" to allow traffic to the default SQL Server port.
- Protocol: Select "TCP" as the protocol.
- Action: Select "Allow" to allow traffic through the rule.
- Priority: Enter a priority for the rule (e.g., "100").
Click on the "Review + create" button to review the details of the new rule.
Click on the "Create" button to create the new rule.
Navigate to the "Security Center" option in the left-hand menu.
Click on the "Recommendations" option.
Locate the recommendation to enable Microsoft Defender for Cloud for SQL Server Virtual Machines.
Click on the "Remediate" button to enable Microsoft Defender for Cloud for the SQL Server VM.
Wait for the remediation process to complete.

That's it! You have successfully remediated the misconfiguration of enabling Microsoft Defender for Cloud for SQL Server Virtual Machines in Azure using the Azure console.

Using CLI

To remediate the misconfiguration "Enable Microsoft Defender for Cloud for SQL Server Virtual Machines" for Azure using Azure CLI, follow the below steps:

Step 1: Open the Azure CLI and login to your Azure account using the command:

az login

Step 2: Once you are logged in, set the subscription in which the SQL Server Virtual Machines are deployed using the command:

az account set --subscription <subscription_id>

Step 3: Enable Microsoft Defender for Cloud for SQL Server Virtual Machines using the command:

az sql vm group security-alert-policy create --resource-group <resource_group_name> --workspace <workspace_id> --storage-account <storage_account_id> --policy-name <policy_name> --disabled false

Note: Replace the placeholders with the actual values of your resource group name, workspace ID, storage account ID and policy name.

Step 4: Verify that Microsoft Defender for Cloud is enabled for SQL Server Virtual Machines using the command:

az sql vm group security-alert-policy show --resource-group <resource_group_name> --workspace <workspace_id> --storage-account <storage_account_id> --policy-name <policy_name>

This command will show the details of the security alert policy for SQL Server Virtual Machines and you can verify that the policy is enabled.

By following these steps, you can remediate the misconfiguration "Enable Microsoft Defender for Cloud for SQL Server Virtual Machines" for Azure using Azure CLI.

Using Python

To enable Microsoft Defender for Cloud for SQL Server Virtual Machines on Azure using Python, you can follow the below steps:

Install the Azure SDK for Python by running the following command:
```
pip install azure
```
Authenticate to your Azure account using the Azure CLI or by providing the credentials in the code.

Use the Azure SDK for Python to retrieve the virtual machine you want to enable Microsoft Defender for Cloud on.

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.network import NetworkManagementClient
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.sql import SqlManagementClient

# Authenticate to Azure
credential = DefaultAzureCredential()
subscription_id = "<your-subscription-id>"

# Initialize the clients for Compute, Network, Resource, and SQL
compute_client = ComputeManagementClient(credential, subscription_id)
network_client = NetworkManagementClient(credential, subscription_id)
resource_client = ResourceManagementClient(credential, subscription_id)
sql_client = SqlManagementClient(credential, subscription_id)

# Retrieve the virtual machine you want to enable Microsoft Defender for Cloud on
vm_name = "<your-vm-name>"
vm_resource_group = "<your-vm-resource-group>"
vm = compute_client.virtual_machines.get(vm_resource_group, vm_name)

Use the Azure SDK for Python to retrieve the SQL Server instance running on the virtual machine.

# Retrieve the SQL Server instance running on the virtual machine
sql_server_name = "<your-sql-server-name>"
sql_server_resource_group = "<your-sql-server-resource-group>"
sql_server = sql_client.servers.get(sql_server_resource_group, sql_server_name)

Use the Azure SDK for Python to enable Microsoft Defender for Cloud for the SQL Server instance.

# Enable Microsoft Defender for Cloud for the SQL Server instance
sql_client.server_security_alert_policies.create_or_update(
    sql_server_resource_group,
    sql_server_name,
    "default",
    {
        "state": "Enabled",
        "email_account_admins": True,
        "retention_days": 90
    }
)

Note: Replace the values in the code with your own values.

Verify that Microsoft Defender for Cloud for SQL Server Virtual Machines is enabled by checking the SQL Server instance in the Azure portal.

You have now successfully enabled Microsoft Defender for Cloud for SQL Server Virtual Machines on Azure using Python.

Using Terraform

resource "azurerm_security_center_subscription_pricing" "sql_server_virtual_machines_defender" {
  # Enable Microsoft Defender for Cloud for SQL Server Virtual Machines at the subscription scope
  resource_type = "SqlServerVirtualMachines"
  tier          = "Standard" # "Standard" enables Defender; "Free" would disable it

  # Optional: explicitly pin to a subscription if your provider is not already scoped
  # subscription_id = "SUBSCRIPTION_ID"
}

This change does not force replacement of any workload resources; it just updates the Defender plan at subscription level.

To verify, terraform plan should show either creation of this resource or a change of tier from "Free" (or unset) to "Standard" for resource_type = "SqlServerVirtualMachines".

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation