Detections
Analytics

2.1.3 Ensure That Microsoft Defender for Databases Is Set To 'On'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Turning on Microsoft Defender for Databases enables threat detection for the instances running your database software. This provides threat intelligence, anomaly detection, and behavior analytics in the Azure Microsoft Defender for Cloud. Instead of being enabled on services like Platform as a Service (PaaS), this implementation will run within your instances as Infrastructure as a Service (IaaS) on the Operating Systems hosting your databases.

Rationale:

Enabling Microsoft Defender for Azure SQL Databases allows your organization more granular control of the infrastructure running your database software. Instead of waiting on Microsoft release updates or other similar processes, you can manage them yourself. Threat detection is provided by the Microsoft Security Response Center (MSRC).

Impact:

Running Defender on Infrastructure as a service (IaaS) may incur increased costs associated with running the service and the instance it is on. Similarly, you will need qualified personnel to maintain the operating system and software updates. If it is not maintained, security patches will not be applied and it may be open to vulnerabilities.

Solution

From Azure Portal

Go to Microsoft Defender for Cloud

Select Environment Settings blade

Click on the subscription name

Select the Defender plans blade

On the line in the table for Azure SQL Databases Select On under Plan.

Select Save

Review the chosen pricing tier. For the Azure Databases resource review the different plan information and choose one that fits the needs of your organization.

From Azure CLI
Run the following commands:

az security pricing create -n 'SqlServers' --tier 'Standard'
az security pricing create -n 'SqlServerVirtualMachines' --tier 'Standard'
az security pricing create -n 'OpenSourceRelationalDatabases' --tier 'Standard'
az security pricing create -n 'CosmosDbs' --tier 'Standard'

From Azure Powershell
Run the following commands:

Set-AzSecurityPricing -Name 'SqlServers' -PricingTier 'Standard'
Set-AzSecurityPricing -Name 'SqlServerVirtualMachines' -PricingTier 'Standard'
Set-AzSecurityPricing -Name 'OpenSourceRelationalDatabases' -PricingTier 'Standard'
Set-AzSecurityPricing -Name 'CosmosDbs' -PricingTier 'Standard'

Default Value:

By default, Microsoft Defender Plans are off.

See Also

https://workbench.cisecurity.org/files/4052

Item Details

References: CSCv7|3.1

Plugin: microsoft_azure

Control ID: f754bd1ce834443f1c67eea7741064474259327b4c5d649eefc7cda7540ef322