Microsoft.sql.servers.elasticpools.delete

​

Event Information

• The Microsoft.Sql.servers.elasticPools.delete event in Azure for AzureDatabaseService indicates that an elastic pool has been deleted in the Azure SQL Database service.
• This event signifies that all databases within the elastic pool have been removed and the resources associated with the elastic pool have been deallocated.
• It is important to note that this event can impact any applications or services that were utilizing the databases within the deleted elastic pool, and appropriate measures should be taken to ensure continuity of operations.

​

Examples

1. Unauthorized deletion: If security is impacted with Microsoft.Sql.servers.elasticPools.delete in Azure for AzureDatabaseService, one example could be an unauthorized user gaining access to the Azure portal or API and deleting an elastic pool that contains critical databases. This could result in data loss and disruption of services.
2. Misconfiguration: Another example could be a misconfiguration of access controls or permissions within Azure. If the necessary security measures are not in place, an attacker could exploit this vulnerability and delete an elastic pool, leading to potential data breaches or service interruptions.
3. Insider threat: A third example could involve an insider threat, where a malicious or disgruntled employee with privileged access intentionally deletes an elastic pool. This could be done to cause harm to the organization, disrupt operations, or gain unauthorized access to sensitive data. Implementing proper access controls and monitoring mechanisms can help mitigate this risk.

​

Remediation

​

Using Console

1. Enable auditing for Azure SQL Database:
   • Go to the Azure portal and navigate to the Azure SQL Database service.
   • Select the specific database you want to enable auditing for.
   • In the left-hand menu, under the Security section, click on “Auditing”.
   • Click on “Enable” to enable auditing for the database.
   • Configure the desired audit settings, such as storage account, retention period, and events to audit.
   • Click on “Save” to apply the changes.
2. Enable encryption at rest for Azure SQL Database:
   • Go to the Azure portal and navigate to the Azure SQL Database service.
   • Select the specific database you want to enable encryption for.
   • In the left-hand menu, under the Security section, click on “Transparent data encryption”.
   • Click on “Enable” to enable encryption at rest for the database.
   • Wait for the encryption process to complete, which may take some time depending on the database size.
3. Enable Azure Security Center recommendations:
   • Go to the Azure portal and navigate to the Azure Security Center.
   • In the left-hand menu, click on “Recommendations”.
   • Review the recommendations provided by Azure Security Center for Azure Database Service.
   • Select the specific recommendation you want to remediate.
   • Follow the provided guidance and instructions to remediate the recommendation.
   • Once remediated, mark the recommendation as resolved in Azure Security Center.

​

Using CLI

1. Enable auditing for Azure SQL Database:
   • Use the az sql server update-auditing command to enable auditing for the Azure SQL Server.
   • Specify the necessary parameters such as --state Enabled and --storage-account-resource-id to configure auditing settings.
   • Example command: az sql server update-auditing --resource-group <resource-group-name> --server <server-name> --state Enabled --storage-account-resource-id <storage-account-resource-id>
2. Enable diagnostic settings for Azure Database for PostgreSQL:
   • Use the az postgres server update command to enable diagnostic settings for the Azure Database for PostgreSQL.
   • Specify the necessary parameters such as --name, --resource-group, and --logs to configure diagnostic settings.
   • Example command: az postgres server update --name <server-name> --resource-group <resource-group-name> --logs <log-categories>
3. Enable encryption for Azure Cosmos DB:
   • Use the az cosmosdb update command to enable encryption for Azure Cosmos DB.
   • Specify the necessary parameters such as --name, --resource-group, and --enable-encryption to configure encryption settings.
   • Example command: az cosmosdb update --name <cosmosdb-account-name> --resource-group <resource-group-name> --enable-encryption true

​

Using Python

1. Monitor and alert on database service events:
   • Use the Azure Monitor service to set up alerts for specific events or metrics related to the Azure Database Service.
   • Create a Log Analytics workspace and configure it to collect and analyze logs from the database service.
   • Use the Azure Monitor Python SDK to programmatically create and manage alerts and log analytics queries.
2. Implement automated backups and retention policies:
   • Use the Azure Python SDK to create a backup policy for your Azure Database Service.
   • Schedule automated backups using the SDK and set the desired retention period.
   • Implement a script that periodically checks the backup status and triggers backups if necessary.
3. Implement security best practices:
   • Use the Azure Python SDK to configure firewall rules and network access control for your Azure Database Service.
   • Implement encryption at rest and in transit using the SDK.
   • Regularly rotate database access credentials and use Azure Key Vault to securely store and manage them.