> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit sqlserver threat detection alerts disabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" in Azure using the Azure console, follow the below steps:

        1. Login to the Azure portal and navigate to the SQL Server that needs to be remediated.

        2. Select the SQL Server and navigate to the "Security" section.

        3. Under the "Security" section, select "Advanced Data Security".

        4. Under the "Advanced Data Security" section, select "Threat detection settings".

        5. In the "Threat detection settings" section, toggle the "Threat detection" button to "On".

        6. Once the "Threat detection" button is turned on, select the "Alerts" tab.

        7. Under the "Alerts" tab, select the "Email recipients" option and add the email addresses of the recipients who should receive the alerts.

        8. Click on the "Save" button to save the changes.

        9. Once the changes are saved, the threat detection alerts will be enabled for the SQL Server, and the specified recipients will receive the alerts.

        By following these steps, the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" will be remediated in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" in AZURE using AZURE CLI, follow the below steps:

        Step 1: Open the AZURE CLI on your local machine or use the AZURE Cloud Shell.

        Step 2: Login to your AZURE account using the command:

        ```
        az login
        ```

        Step 3: Select the subscription that contains the SQL Server that you want to remediate:

        ```
        az account set --subscription <subscription_id>
        ```

        Step 4: Enable the Threat Detection alerts for the SQL Server using the below command:

        ```
        az sql server threat-policy update --resource-group <resource_group_name> --server <sql_server_name> --state Enabled
        ```

        Replace the `<resource_group_name>` with the name of the resource group that contains the SQL Server and `<sql_server_name>` with the name of the SQL Server.

        Step 5: Verify the Threat Detection alerts status using the below command:

        ```
        az sql server threat-policy show --resource-group <resource_group_name> --server <sql_server_name>
        ```

        This command will show the Threat Detection policy for the SQL Server. Verify that the `state` parameter is set to `Enabled`.

        Step 6: Exit the AZURE CLI using the command:

        ```
        exit
        ```

        With the above steps, you have successfully remediated the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" for AZURE using AZURE CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" in Azure using Python, you can follow the below steps:

        Step 1: Install the Azure SDK for Python using the pip package manager. You can use the following command to install the package:

        ```python theme={null}
        pip install azure-mgmt-sql
        ```

        Step 2: Authenticate with Azure using the Azure CLI. You can use the following command to authenticate:

        ```python theme={null}
        from azure.common.credentials import UserPassCredentials
        from azure.mgmt.resource import ResourceManagementClient
        from azure.mgmt.sql import SqlManagementClient

        subscription_id = '<your-subscription-id>'
        credentials = UserPassCredentials(
            '<your-username>', '<your-password>')

        resource_client = ResourceManagementClient(
            credentials, subscription_id)
        sql_client = SqlManagementClient(credentials, subscription_id)
        ```

        Step 3: Get the list of SQL servers in your Azure subscription. You can use the following code to get the list of SQL servers:

        ```python theme={null}
        servers = sql_client.servers.list()
        ```

        Step 4: Enable Threat Detection Alerts for each SQL server. You can use the following code to enable Threat Detection Alerts:

        ```python theme={null}
        for server in servers:
            server_name = server.name
            resource_group_name = server.resource_group
            server_properties = sql_client.servers.get(resource_group_name, server_name)
            server_properties.security_alert_policy.state = 'Enabled'
            server_properties.security_alert_policy.email_account_admins = True
            server_properties.security_alert_policy.email_addresses = ['<your-email-address>']
            sql_client.servers.create_or_update(resource_group_name, server_name, server_properties)
        ```

        In the above code, you need to replace `<your-email-address>` with your email address.

        Step 5: Verify that Threat Detection Alerts are enabled for each SQL server. You can use the following code to verify:

        ```python theme={null}
        for server in servers:
            server_name = server.name
            resource_group_name = server.resource_group
            server_properties = sql_client.servers.get(resource_group_name, server_name)
            print(server_properties.security_alert_policy.state)
        ```

        This will print the state of the Threat Detection Alerts for each SQL server.

        By following the above steps, you can remediate the misconfiguration "Threat Detection Alerts Disabled for SQL Servers" in Azure using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_mssql_server" "sql_server" {
          name                         = "SQL_SERVER_NAME"        # substitute your server name
          resource_group_name          = "RESOURCE_GROUP_NAME"    # substitute your RG
          location                     = "AZURE_REGION"           # substitute your region
          version                      = "12.0"
          administrator_login          = "ADMIN_USERNAME"         # substitute admin user
          administrator_login_password = "ADMIN_PASSWORD"         # substitute admin password
        }

        # Enable threat detection alerts (server security alert policy)
        resource "azurerm_mssql_server_security_alert_policy" "sql_server_threat_detection" {
          server_id = azurerm_mssql_server.sql_server.id

          state = "Enabled"

          # Do NOT disable any threat detection alerts – leave disabled_alerts unset or empty
          # disabled_alerts = []

          # One of these sinks is required: either storage or Log Analytics. Example with storage:
          storage_endpoint           = azurerm_storage_account.sql_audit.primary_blob_endpoint
          storage_account_access_key = azurerm_storage_account.sql_audit.primary_access_key

          email_account_admins = "Enabled"
          email_addresses      = ["SECURITY_ALERT_EMAIL@example.com"] # substitute recipients
        }

        resource "azurerm_storage_account" "sql_audit" {
          name                     = "SQLAUDITSTORAGE"          # globally unique; substitute
          resource_group_name      = "RESOURCE_GROUP_NAME"      # substitute your RG
          location                 = "AZURE_REGION"             # substitute your region
          account_tier             = "Standard"
          account_replication_type = "LRS"
        }
        ```

        This change does not force replacement of the SQL server; it updates the attached security alert policy in place.

        Verification: `terraform plan` should show `azurerm_mssql_server_security_alert_policy.sql_server_threat_detection` created or changed with `state: "" => "Enabled"` and no `disabled_alerts` entries.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>