Detections
Analytics
SQLI-22-014800 - SQL Server must generate audit records when successful and unsuccessful logons or connection attempts occur.
Information
For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server. It is also necessary to track failed attempts to log on to SQL Server. While positive identification may not be possible in a case of failed authentication, as much information as possible about the incident must be captured.Satisfies: SRG-APP-000503-DB-000350, SRG-APP-000503-DB-000351, SRG-APP-000506-DB-000353
Solution
Add the required events to the server audit specification to audit denied actions.Refer to the supplemental file "SQL2022Audit.sql" script.
Reference: https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine?
Alternatively, enable "Both failed and successful logins".
1. In SQL Management Studio, right-click on the instance.
2. Select "Properties".
3. Select "Security" on the left side.
4. Select "Both failed and successful logins".
5. Click "OK".
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2022_Y26M04_STIG.zip
Item Details
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-271375r1111093_rule, STIG-ID|SQLI-22-014800, Vuln-ID|V-271375
Plugin: MS_SQLDB
Control ID: 3010211ec71ba78132966d3c9ca9538eaeb3087d9561eea674f10eef5002f648