STIGQter STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must initiate session auditing upon startup.

DISA Rule

SV-255328r960888_rule

Vulnerability Number

V-255328

Group Title

SRG-APP-000092-DB-000208

Rule Version

ASQL-00-004700

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Deploy an Azure SQL Database audit.

Refer to the supplemental file "AzureSQLDatabaseAudit.txt" PowerShell script.

Reference:
https://docs.microsoft.com/en-us/powershell/module/az.sql/set-azsqlserveraudit

Check Contents

When Audits are enabled, they start up when the audits are enabled and remain operating until the audit is disabled.

Check if an audit is configured and enabled.
To determine if session auditing is configured and enabled, follow the instructions below:
Run this TSQL command to determine if SQL Auditing is configured and enabled:
SELECT *
FROM sys.database_audit_specifications
where (name = 'SqlDbAuditing_ServerAuditSpec'
or name = 'SqlDbAuditing_AuditSpec')
and is_state_enabled = 1

All currently defined audits for the Azure SQL Database instance will be listed. If no audits are returned, this is a finding.

Vulnerability Number

V-255328

Documentable

False

Rule Version

ASQL-00-004700

Severity Override Guidance

When Audits are enabled, they start up when the audits are enabled and remain operating until the audit is disabled.

Check if an audit is configured and enabled.
To determine if session auditing is configured and enabled, follow the instructions below:
Run this TSQL command to determine if SQL Auditing is configured and enabled:
SELECT *
FROM sys.database_audit_specifications
where (name = 'SqlDbAuditing_ServerAuditSpec'
or name = 'SqlDbAuditing_AuditSpec')
and is_state_enabled = 1

All currently defined audits for the Azure SQL Database instance will be listed. If no audits are returned, this is a finding.

Check Content Reference

M

Target Key

5500