ArcMachineScanResults_GetLatest.json

{
  "parameters": {
    "scanId": "latest",
    "scanResultId": "VA2063",
    "workspaceId": "55555555-6666-7777-8888-999999999999",
    "api-version": "2020-07-01-preview",
    "resourceId": "subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master"
  },
  "responses": {
    "200": {
      "body": {
        "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
        "name": "VA2063",
        "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
        "properties": {
          "ruleId": "VA2063",
          "status": "Finding",
          "isTrimmed": false,
          "queryResults": [
            [
              "Test",
              "0.0.0.0",
              "125.125.125.125"
            ]
          ],
          "remediation": {
            "description": "Remove server firewall rules that grant excessive access",
            "scripts": [
              "EXECUTE sp_delete_firewall_rule N'Test';"
            ],
            "automated": false,
            "portalLink": "ReviewServerFirewallRules"
          },
          "baselineAdjustedResult": {
            "baseline": {
              "expectedResults": [
                [
                  "Test",
                  "0.0.0.0",
                  "125.125.125.125"
                ]
              ],
              "updatedTime": "2020-02-04T12:49:41.027771+00:00"
            },
            "status": "NonFinding",
            "resultsNotInBaseline": [],
            "resultsOnlyInBaseline": []
          },
          "ruleMetadata": {
            "ruleId": "VA2063",
            "severity": "High",
            "category": "SurfaceAreaReduction",
            "ruleType": "NegativeList",
            "title": "Server-level firewall rules should not grant excessive access",
            "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
            "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
            "queryCheck": {
              "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
              "expectedResult": [],
              "columnNames": [
                "Firewall Rule Name",
                "Start Address",
                "End Address"
              ]
            },
            "benchmarkReferences": []
          }
        }
      }
    }
  }
}