Azure SQL Database must offload audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

An XCCDF Rule

Description

<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Offloading is a common process in information systems with limited audit storage capacity. Azure SQL Database may write audit records blob storage, log analytics, or event hub. Multiple methods should be used to ensure audit files are retained, or immutable storage should be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-255377r961860_rule
Severity: Medium
References: CCI-001851
Updated: 17 days ago

Enable immutable storage so that audit logs cannot be modified or deleted accidently.
https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-policy-configure-container-scope?tabs=azure-portal

To configure a time-based retention policy on a container with the Azure portal, follow these steps:

1. Navigate to the desired container.2. Select "More" on the right, then select "Access policy".
3. In the Immutable blob storage section, select "Add policy".
4. In the Policy type field, select "Time-based retention", and specify the retention period in days.
5. To create a policy with container scope, do not check the box for "Enable" version-level immutability.
6. If desired, select "Allow additional protected appends" to enable writes to append blobs that are protected by an immutability policy.

PowerShell:
Set-AzRmStorageContainerImmutabilityPolicy -ResourceGroupName <resource-group> `
    -StorageAccountName <storage-account> `
    -ContainerName <container> `
    -ImmutabilityPeriod 10

Alternatively, enable at least two types of audit storage for the Azure SQL Database.
In the Azure Portal, select "Auditing".
Check at least two of the available storage types and select "Save".

Azure SQL Database must offload audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

Description

Remediation - Manual Procedure