lacework-global-542
Set Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners' for each SQL Server (Automated)
Profile Applicability
• Level 1
Description
Enable Vulnerability Assessment (VA) setting 'Also send email notifications to admins and subscription owners'.
Rationale
VA scan reports and alerts will be sent to admins and subscription owners by enabling setting 'Also send email notifications to admins and subscription owners'. This may help in reducing time required for identifying risks and taking corrective measures.
Impact
Enabling the Microsoft Defender for SQL
features will incur additional costs for each SQL server.
Audit
From Azure Portal
- Go to
SQL servers
- Select a server instance
- Click on
Security Center
- Ensure that
Microsoft Defender for SQL
is set toEnabled
- Select
Configure
next toEnabled at subscription-level
- In Section
Vulnerability Assessment Settings
, EnsureStorage Accounts
is configured. - In Section
Vulnerability Assessment Settings
, EnsureAlso send email notifications to admins and subscription owners
is checked/enabled.
From Azure Powershell
Get the list of all SQL Servers
Get-AZSqlServer
For each Server
Get-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName <resource group name> -ServerName <server name>
Ensure that value for parameter EmailSubscriptionAdmin
is set to true.
Sample Output:
ResourceGroupName : ResourceGroup01
ServerName : Server01
StorageAccountName : mystorage
ScanResultsContainerName : vulnerability-assessment
RecurringScansInterval : weekly
EmailSubscriptionAdmins : False
NotificationEmail : {}
Remediation
From Azure Portal
- Go to
SQL servers
. - Select a server instance.
- Click
Microsoft Defender for Cloud
. - Select
Configure
next toEnabled at subscription-level
. - In Section
Vulnerability Assessment Settings
, configureStorage Accounts
if not already. - Check/enable
Also send email notifications to admins and subscription owners
. - Click
Save
.
From Azure Powershell
If not already, Enable Advanced Data Security for a SQL Server:
Set-AZSqlServerThreatDetectionPolicy -ResourceGroupName <resource group name> -ServerName <server name> -EmailAdmins $True
To enable ADS-VA service and Set 'Also send email notifications to admins and subscription owners'
Update-AzSqlServerVulnerabilityAssessmentSetting -ResourceGroupName "<resource group name>" -ServerName "<Server Name>" -StorageAccountName "<Storage Name from same subscription and same Location" -ScanResultsContainerName "vulnerability-assessment" -RecurringScansInterval Weekly -EmailSubscriptionAdmins $true -NotificationEmail @("mail1@mail.com" , "mail2@mail.com")
References
https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment
https://docs.microsoft.com/en-us/rest/api/sql/servervulnerabilityassessments/listbyserver
https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Update-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0
https://docs.microsoft.com/en-in/powershell/module/Az.Sql/Get-AzSqlServerVulnerabilityAssessmentSetting?view=azps-2.6.0
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-6-perform-software-vulnerability-assessments