Skip to content

Latest commit

 

History

History
40 lines (22 loc) · 1.89 KB

README.md

File metadata and controls

40 lines (22 loc) · 1.89 KB
Raw

Azure Ensure SQL Server ATP (Advanced Threat Protection) Enabled

What it does

This policy checks all Azure SQL Servers to ensure that they have ATP (Advanced Threat Protection) enabled. An incident is raised with the offending SQL Servers if any are found that don't.

Functional Details

The Azure Resource Manager API is used to get a list of subscriptions and SQL Servers within those subscriptions. The policy then queries the ATP (Advanced Threat Protection) endpoint for each SQL Server and checks the "properties.isEnabled" field to determine if ATP is enabled or not.

Input Parameters

This policy has the following input parameters required when launching the policy.

  • Email addresses to notify - Email addresses of the recipients you wish to notify when new incidents are created
  • Azure Endpoint - Azure Endpoint to access resources

Prerequisites

This policy uses credentials for connecting to the cloud -- in order to apply this policy you must have a credential registered in the system that is compatible with this policy. If there are no credentials listed when you apply the policy, please contact your cloud admin and ask them to register a credential that is compatible with this policy. The information below should be consulted when creating the credential.

Credential configuration

For administrators creating and managing credentials to use with this policy, the following information is needed:

Provider tag values to match this policy: azure_rm

Required permissions in the provider:

  • Microsoft.Resources/subscriptions/read
  • Microsoft.Sql/servers/read
  • Microsoft.Sql/servers/securityAlertPolicies/read

Supported Clouds

  • Azure Resource Manager

Cost

This Policy Template does not incur any cloud costs.