STIGQter STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

SQL Server must initiate session auditing upon startup.

DISA Rule

SV-213940r617437_rule

Vulnerability Number

V-213940

Group Title

SRG-APP-000092-DB-000208

Rule Version

SQL6-D0-004700

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the SQL Audit(s) to automatically start during system start-up.

ALTER SERVER AUDIT [<Server Audit Name>] WITH STATE = ON

Execute the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE status_desc = 'STARTED'

Ensure the SQL STIG Audit is configured to initiate session auditing upon startup.

Check Contents

When Audits are enabled, they start up when the instance starts.
https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2

Check if an audit is configured and enabled.

Execute the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE status_desc = 'STARTED'

All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

Vulnerability Number

V-213940

Documentable

False

Rule Version

SQL6-D0-004700

Severity Override Guidance

When Audits are enabled, they start up when the instance starts.
https://msdn.microsoft.com/en-us/library/cc280386.aspx#Anchor_2

Check if an audit is configured and enabled.

Execute the following query:

SELECT name AS 'Audit Name',
status_desc AS 'Audit Status',
audit_file_path AS 'Current Audit File'
FROM sys.dm_server_audit_status
WHERE status_desc = 'STARTED'

All currently defined audits for the SQL server instance will be listed. If no audits are returned, this is a finding.

Check Content Reference

M

Target Key

3993

Comments