Azure SQL Server threat detection alerts are not enabled for all threat types misconfiguration detec

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_25
Category - Subcategory	Monitoring - Alerting And Notifications
Provider	AZURE
Severity	HIGH
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Enabling all Threat Detection Types protects against SQL injection, database vulnerabilities, and any other anomalous activities. We recommend you enable all types of threat detection on SQL servers.

How to Fix

Resource: Microsoft.Sql/servers/databases

[source,go]

{ "type": "Microsoft.Sql/servers/databases", "apiVersion": "2020-08-01-preview", "name": "[variables('dbName')]", "location": "[parameters('location')]", "sku": { "name": "[parameters('sku')]" }, "kind": "v12.0,user", "properties": { "collation": "SQL_Latin1_General_CP1_CI_AS", "maxSizeBytes": "[mul(parameters('maxSizeMB'), 1048576)]", "catalogCollation": "SQL_Latin1_General_CP1_CI_AS", "zoneRedundant": false, "readScale": "Disabled", "storageAccountType": "GRS" }, "resources": [ { "type": "Microsoft.Sql/servers/databases/securityAlertPolicies", "apiVersion": "2014-04-01", "name": "[concat(variables('dbName'), '/current')]", "location": "[parameters('location')]", "dependsOn": [ "[resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('databaseName'))]" ], "properties": {

•           "state": "Enabled",

•           "disabledAlerts": "",
            "emailAddresses": "[variables('emailAddresses')[copyIndex()]]",
            "emailAccountAdmins": "Enabled"
        }
    }

  ] }

---