STIGQter: STIG Summary: Microsoft Azure SQL Database Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 02 Jul 2025:

Azure SQL Database must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.

DISA Rule

SV-255344r961398_rule

Vulnerability Number

V-255344

Group Title

SRG-APP-000359-DB-000319

Rule Version

ASQL-00-011000

Severity

CAT II

CCI(s)

• CCI-001855 - Provide a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit log storage volume reaches an organization-defined percentage of repository maximum audit log storage capacity.

Weight

10

Fix Recommendation

Utilize Alerts in Microsoft Azure Monitoring and/or third-party tools to configure the system to notify appropriate support staff immediately upon storage volume utilization reaching 75 percent.

https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

Check Contents

Azure SQL Database must provide notice upon audit storage reaching capacity.

Verify if an Azure Rule exists with the following command example:

$storageAcct = Get-AzStorageAccount -ResourceGroupName "Name of RG for Audit Storage" -Name "Audit Storage Account Name"
$metric = Get-AzMetricAlertRuleV2 | Where-Object TargetResourceId -eq $storageAcct.Id
$metric.Criteria

If no alert exists, this is a finding.

If the criteria does not match 75 percent or less than the maximum capacity of 5 TiB, this is a finding.

Vulnerability Number

V-255344

Documentable

False

Rule Version

ASQL-00-011000

Severity Override Guidance

Azure SQL Database must provide notice upon audit storage reaching capacity.

Verify if an Azure Rule exists with the following command example:

$storageAcct = Get-AzStorageAccount -ResourceGroupName "Name of RG for Audit Storage" -Name "Audit Storage Account Name"
$metric = Get-AzMetricAlertRuleV2 | Where-Object TargetResourceId -eq $storageAcct.Id
$metric.Criteria

If no alert exists, this is a finding.

If the criteria does not match 75 percent or less than the maximum capacity of 5 TiB, this is a finding.

Check Content Reference

M

Target Key

5500