2.3 Ensure that Azure Defender is set to On for Azure SQL database servers

Information

Turning on Azure Defender enables threat detection for Azure SQL database servers, providing threat intelligence, anomaly detection, and behavior analytics in the Azure Security Center.

Rationale:

Enabling Azure Defender for Azure SQL database servers allows for greater defense-in-depth, with threat detection provided by the Microsoft Security Response Center (MSRC).

Impact:

Turning on Azure Defender in Azure Security Center incurs an additional cost per resource.

Solution

From Azure Console

Go to Security Center

Select Pricing & settings blade

Click on the subscription name

Select the Azure Defender plans blade

On the line in the table for Azure SQL database servers Select On under Plan.

Select Save

Using Azure Command Line Interface 2.0
Use the below command to enable Standard pricing tier for Azure SQL database servers

az account get-access-token --query '{subscription:subscription,accessToken:accessToken}' --out tsv | xargs -L1 bash -c 'curl -X PUT -H 'Authorization: Bearer $1' -H 'Content-Type: application/json' https://management.azure.com/subscriptions/$0/providers/Microsoft.Security/pricings/SqlServers?api-version=2018-06-01 [email protected]'input.json''

Where input.json contains the Request body json data as mentioned below.

{
'id': '/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/pricings/SqlServers',
'name': 'SqlServers',
'type': 'Microsoft.Security/pricings',
'properties': {
'pricingTier': 'Standard'
}
}

Default Value:

By default, Azure Defender off is selected.

See Also

https://workbench.cisecurity.org/files/3459

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-3, CSCv7|8

Plugin: microsoft_azure

Control ID: c275148af8fa154da92e7967165bdd152d912a44fd6729164ff09337872da602