> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure audit sqlserver audit action groups invalid remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration related to AuditActionGroups in Azure, please follow the below steps: 1. Login to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)). 2. Go to the Azure Active Directory service. 3. Select the "Audit logs" option under the Monitoring section. 4. In the Audit logs blade, click on the "Diagnostic settings" option. 5. Select the diagnostic setting that needs to be remediated. 6. In the "Diagnostic settings" blade, scroll down to the "Categories" section. 7. In the "Categories" section, ensure that the "AuditLogs" option is selected. 8. Under the "AuditLogs" option, select the "Select specific actions" radio button. 9. In the "Select specific actions" section, ensure that all the required AuditActionGroups are selected. 10. Click on the "Save" button to save the changes. By following the above steps, the misconfiguration related to AuditActionGroups in Azure can be remediated. # To remediate the misconfiguration of AuditActionGroups in auditing for AZURE using AZURE CLI, follow these steps: 1. Open the AZURE CLI on your local machine or use the AZURE Cloud Shell. 2. Run the following command to get the current configuration of AuditActionGroups: ``` az monitor activity-log list --query [].categories.actionGroups ``` 3. Check the output of the above command to see if AuditActionGroups are set properly. If not, proceed to the next step. 4. Run the following command to set the AuditActionGroups: ``` az monitor activity-log update --set categories.actionGroups= ``` Replace `` with the appropriate list of action groups. For example, if you want to set the AuditActionGroups to "Write", "Delete", and "Action", the command would be: ``` az monitor activity-log update --set categories.actionGroups=Write,Delete,Action ``` 5. Verify the configuration by running the first command again: ``` az monitor activity-log list --query [].categories.actionGroups ``` The output should now show the updated list of AuditActionGroups. By following these steps, you can remediate the misconfiguration of AuditActionGroups in auditing for AZURE using AZURE CLI. To remediate the misconfiguration of AuditActionGroups in Azure using Python, follow the below steps: 1. Import the necessary libraries: ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.monitor import MonitorManagementClient ``` 2. Set the credentials: ```python theme={null} credential = DefaultAzureCredential() subscription_id = '' ``` 3. Initialize the MonitorManagementClient: ```python theme={null} monitor_client = MonitorManagementClient(credential, subscription_id) ``` 4. Get the existing AuditActionGroups: ```python theme={null} audit_action_groups = monitor_client.activity_log_alerts.list_action_groups(resource_group_name='', action_group_name='') ``` 5. Update the AuditActionGroups: ```python theme={null} updated_audit_action_groups = [ { "id": "/subscriptions//resourceGroups//providers/microsoft.insights/actionGroups/", "action_group_type": "CustomEmail/SMS/Push/Voice", "short_name": "", "email_receivers": [ { "name": "", "email_address": "", "use_common_alert_schema": True } ] } ] monitor_client.action_groups.create_or_update(resource_group_name='', action_group_name='', parameters=updated_audit_action_groups) ``` 6. Verify the updated AuditActionGroups: ```python theme={null} updated_audit_action_groups = monitor_client.activity_log_alerts.list_action_groups(resource_group_name='', action_group_name='') ``` By following these steps, you can remediate the misconfiguration of AuditActionGroups in Azure using Python. ```hcl theme={null} resource "azurerm_mssql_server" "sql_server" { name = "SQL_SERVER_NAME" # substitute your server name resource_group_name = "RESOURCE_GROUP_NAME" # substitute your RG location = "AZURE_REGION" # substitute your region version = "12.0" administrator_login = "SQL_ADMIN_LOGIN" administrator_login_password = "SQL_ADMIN_PASSWORD" } resource "azurerm_mssql_database" "sql_db" { name = "SQL_DATABASE_NAME" # substitute your DB name server_id = azurerm_mssql_server.sql_server.id sku_name = "S0" max_size_gb = 10 zone_redundant = false } # Database-level auditing with explicit AuditActionGroups (audit_actions_and_groups) resource "azurerm_mssql_database_extended_auditing_policy" "sql_db_audit" { database_id = azurerm_mssql_database.sql_db.id # Storage for audit logs storage_endpoint = azurerm_storage_account.audit_sa.primary_blob_endpoint storage_account_access_key = azurerm_storage_account.audit_sa.primary_access_key storage_account_access_key_is_secondary = false retention_in_days = 90 # Configure AuditActionGroups to capture critical activities audit_actions_and_groups = [ "DATABASE_LOGOUT_GROUP", "DATABASE_ROLE_MEMBER_CHANGE_GROUP", "DATABASE_OBJECT_CHANGE_GROUP", "DATABASE_OBJECT_PERMISSION_CHANGE_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP", "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "BATCH_COMPLETED_GROUP", "BATCH_STARTED_GROUP", "APPLICATION_ROLE_CHANGE_PASSWORD_GROUP" ] } # Example storage account for audit logs (required by the auditing policy) resource "azurerm_storage_account" "audit_sa" { name = "AUDIT_STORAGE_ACCOUNT_NAME" # globally unique resource_group_name = "RESOURCE_GROUP_NAME" # substitute your RG location = "AZURE_REGION" # substitute your region account_tier = "Standard" account_replication_type = "LRS" } ``` This change does not force replacement of the SQL database or server; it updates the database auditing policy in place. To verify, `terraform plan` should show an update to `azurerm_mssql_database_extended_auditing_policy.sql_db_audit` with the `audit_actions_and_groups` argument being added or changed to the list you configured.