STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

DISA Rule

SV-255329r960909_rule

Vulnerability Number

V-255329

Group Title

SRG-APP-000101-DB-000044

Rule Version

ASQL-00-005500

Severity

CAT II

CCI(s)

CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

Fix Recommendation

Design and deploy an audit that captures all auditable events and data items. In the event a third-party tool is used for auditing, it must contain all the required information, including but not limited to, events, type, location, subject, date and time, and who made the change.

Implement additional custom audits to capture the additional organizational required information.

Check Contents

If an Azure SQL Database Audit is not in use for audit purposes, this is a finding, unless a third-party product is being used that can perform detailed auditing for Azure SQL Database.

Review system documentation to determine whether Azure SQL Database is required to audit any events and fields in addition to those in the standard audit.

If there are none specified, this is not a finding.

If Azure SQL Database Audit is in use, compare the audit specification(s) with the documented requirements.

If any such requirement is not satisfied by the audit specification(s) (or by supplemental, locally-deployed mechanisms), this is a finding.

Vulnerability Number

V-255329

Documentable

False

Rule Version

ASQL-00-005500

Severity Override Guidance

Check Content Reference

Target Key

5500