> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitor SQL Auditing setting is not enabled

### More Info:

Enable SQL Auditing recommendations for virtual machines.

### Risk Level

Low

### Address

Operational Maturity, Security

### Compliance Standards

* HIPAA

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Monitor SQL Auditing setting is not enabled" misconfiguration in Azure using the Azure console, you can follow these steps:

        1. Log in to the Azure portal and navigate to the SQL Server that you want to remediate.

        2. Click on "Auditing" under the "Security" section in the left-hand menu.

        3. Click on "Enable Auditing" at the top of the page.

        4. In the "Auditing settings" section, select the database(s) that you want to audit.

        5. Choose the events that you want to audit by selecting the appropriate checkboxes.

        6. Choose the storage account where you want to store the audit logs.

        7. Click on "Save" to enable auditing.

        8. Once auditing is enabled, you can view the audit logs by clicking on "Audit logs" under the "Security" section in the left-hand menu.

        9. Verify that the audit logs are being generated properly.

        By following these steps, you can remediate the "Monitor SQL Auditing setting is not enabled" misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Monitor SQL Auditing setting is not enabled" misconfiguration in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.

        2. Connect to your Azure account using the following command:

        ```
        az login
        ```

        3. Once you are logged in, select the Azure subscription where the SQL Server resides:

        ```
        az account set --subscription <subscription_id>
        ```

        4. Enable the SQL Auditing setting using the following command:

        ```
        az sql server audit-policy update --state Enabled --storage-account <storage_account_name> --storage-key <storage_account_key> --storage-endpoint <storage_account_endpoint> --retention-days <number_of_days> --resource-group <resource_group_name> --server <sql_server_name>
        ```

        Replace the placeholders with the appropriate values:

        * `<storage_account_name>`: The name of the storage account where the audit logs will be stored.
        * `<storage_account_key>`: The access key for the storage account.
        * `<storage_account_endpoint>`: The endpoint for the storage account.
        * `<number_of_days>`: The number of days to retain the audit logs.
        * `<resource_group_name>`: The name of the resource group where the SQL Server resides.
        * `<sql_server_name>`: The name of the SQL Server.

        5. Verify that the SQL Auditing setting is enabled by running the following command:

        ```
        az sql server audit-policy show --resource-group <resource_group_name> --server <sql_server_name>
        ```

        This will display the current audit policy settings for the SQL Server. Check that the `state` property is set to `Enabled`.

        Once you have completed these steps, the "Monitor SQL Auditing setting is not enabled" misconfiguration should be remediated in Azure.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Monitor SQL Auditing setting is not enabled" misconfiguration for Azure using Python, you can use the Azure SDK for Python. Here are the steps to follow:

        1. Install the Azure SDK for Python using pip:

        ```
        pip install azure-mgmt-sql
        ```

        2. Import the necessary modules:

        ```
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.sql import SqlManagementClient
        ```

        3. Set up the credentials to authenticate to Azure:

        ```
        subscription_id = '<your-subscription-id>'
        tenant_id = '<your-tenant-id>'
        client_id = '<your-client-id>'
        client_secret = '<your-client-secret>'

        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=client_secret,
            tenant=tenant_id
        )
        ```

        4. Create a SqlManagementClient object:

        ```
        sql_client = SqlManagementClient(
            credentials=credentials,
            subscription_id=subscription_id
        )
        ```

        5. Check if SQL auditing is enabled:

        ```
        server_name = '<your-server-name>'
        database_name = '<your-database-name>'

        database = sql_client.databases.get(
            server_name,
            database_name
        )

        auditing_settings = sql_client.auditing_policies.get(
            server_name,
            database_name
        )

        if not auditing_settings.state == 'Enabled':
            # SQL auditing is not enabled, remediate it
        ```

        6. Remediate the misconfiguration by enabling SQL auditing:

        ```
        from azure.mgmt.sql.models import (
            ServerAuditingPolicy,
            ServerAuditingPolicyState,
            ServerAuditPolicy
        )

        audit_policy = ServerAuditPolicy(
            audit_actions_and_groups=['SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP'],
            retention_days=30
        )

        auditing_policy = ServerAuditingPolicy(
            state=ServerAuditingPolicyState.enabled,
            storage_account_access_key='<your-storage-account-access-key>',
            storage_endpoint='<your-storage-endpoint>',
            storage_account_access_key_is_secondary=False,
            audit_logs_table_name='AuditLogs',
            audit_logs_table_state='Enabled',
            audit_policy=audit_policy
        )

        sql_client.auditing_policies.create_or_update(
            server_name,
            database_name,
            auditing_policy
        )
        ```

        7. Verify that SQL auditing is now enabled:

        ```
        auditing_settings = sql_client.auditing_policies.get(
            server_name,
            database_name
        )

        if auditing_settings.state == 'Enabled':
            # SQL auditing is now enabled
        ```

        These steps should help you remediate the "Monitor SQL Auditing setting is not enabled" misconfiguration for Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # This specific finding cannot be remediated on the requested surface
        # ("azure-securityandidentity-securitycenter-policyassignment") via Terraform.

        # Azure Monitor SQL Auditing recommendations in Microsoft Defender for Cloud
        # are not controlled by a toggle on a Security Center / Defender policy
        # assignment resource that the azurerm provider exposes. They are generated
        # based on the actual SQL auditing configuration on your SQL resources
        # (SQL Server, SQL Database, SQL Managed Instance, or SQL on VMs) and on
        # built‑in Defender for Cloud policies.

        # To address this finding you must:
        # 1. Enable SQL auditing on the relevant SQL resources.
        # 2. Ensure the relevant built‑in Defender for Cloud / Azure Policy initiative
        #    is assigned (typically done automatically at the subscription level).

        # Console steps (high level), since there is no Terraform argument for the
        # requested resource type:
        # - Go to "Microsoft Defender for Cloud" in the Azure Portal.
        # - Under "Environment settings" select the subscription.
        # - Ensure the default security initiative is assigned (it includes the
        #   SQL auditing recommendation).
        # - For SQL Server / SQL Database / SQL Managed Instance:
        #     * Open each resource in the Portal.
        #     * Configure "Auditing" to be enabled and send logs to Log Analytics,
        #       Event Hub, or a Storage Account as required.
        # - For SQL on VMs:
        #     * Use the SQL IaaS Agent extension or in‑guest configuration to enable
        #       auditing inside the VM.

        # Because the azurerm provider does not expose a
        # `azure-securityandidentity-securitycenter-policyassignment` resource or a
        # setting to toggle "Monitor SQL Auditing" in Defender for Cloud, there is no
        # valid Terraform configuration to apply here without managing a different
        # surface than requested.

        # Verification:
        # - `terraform plan` should show no changes related to a
        #   "Security Center policy assignment" for this specific control; the
        #   improvement in the recommendation will appear only after you configure
        #   SQL auditing on the actual SQL resources and confirm policy assignment
        #   in the Portal.
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>