Detections
Analytics

SQL6-D0-015100 - SQL Server must generate audit records showing starting and ending time for user access to the database(s).

Information

For completeness of forensic analysis, it is necessary to know how long a user's (or other principal's) connection to SQL Server lasts. This can be achieved by recording disconnections, in addition to logons/connections, in the audit logs.

Disconnection may be initiated by the user or forced by the system (as in a timeout) or result from a system or network failure. To the greatest extent possible, all disconnections must be logged.

Solution

Add the 'LOGOUT_GROUP' to the server audit specification
USE [master];
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = OFF);
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION ADD (LOGOUT_GROUP);
GO

ALTER SERVER AUDIT SPECIFICATION STIG_AUDIT_SERVER_SPECIFICATION WITH (STATE = ON);
GO

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2016_Y26M01_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-214017r961830_rule, STIG-ID|SQL6-D0-015100, STIG-Legacy|SV-94001, STIG-Legacy|V-79295, Vuln-ID|V-214017

Plugin: MS_SQLDB

Control ID: d84d7c90e38d10d7e9492ea65924b587d288a90f4edf21d8fed10a5b52d0e597