STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must generate audit records for all direct access to the database(s).

DISA Rule

SV-271381r1111095_rule

Vulnerability Number

V-271381

Group Title

SRG-APP-000508-DB-000358

Rule Version

SQLI-22-015500

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

Check the system documentation for required SQL Server Audits. Remove any Audit filters that exclude or reduce required auditing. Update filters to ensure direct access is not excluded.

Check Contents

Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio, execute the following query:
SELECT name AS AuditName, predicate AS AuditFilter
FROM sys.server_audits
WHERE predicate IS NOT NULL

If any audits are returned, review the associated filters. If any direct access to the database(s) is being excluded, this is a finding.

Vulnerability Number

V-271381

Documentable

False

Rule Version

SQLI-22-015500

Severity Override Guidance

Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio, execute the following query:
SELECT name AS AuditName, predicate AS AuditFilter
FROM sys.server_audits
WHERE predicate IS NOT NULL

If any audits are returned, review the associated filters. If any direct access to the database(s) is being excluded, this is a finding.

Check Content Reference

M

Target Key

5677