You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/sql-azure-vulnerability-assessment-enable.md
+8-7Lines changed: 8 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,6 +29,7 @@ When you enable the Defender for Azure SQL plan in Defender for Cloud, Defender
29
29
When you enable the Defender for Azure SQL plan in Defender for Cloud, Defender for Cloud automatically enables Advanced Threat Protection and vulnerability assessment with the express configuration for all Azure SQL databases in the selected subscription.
30
30
31
31
You can enable vulnerability assessment in two ways:
32
+
32
33
-[Express configuration](#express-configuration)
33
34
-[Classic configuration](#classic-configuration)
34
35
@@ -37,10 +38,10 @@ You can enable vulnerability assessment in two ways:
37
38
**To enable vulnerability assessment without a storage account, using the express configuration**:
38
39
39
40
1. Sign in to the [Azure portal](https://portal.azure.com/).
40
-
1. Open the specific Azure SQL Database resource.
41
+
1. Open the specific Azure SQL Database resource.
41
42
1. Under the Security heading, select **Defender for Cloud**.
42
43
1. Enable the express configuration of vulnerability assessment:
43
-
44
+
44
45
-**If vulnerability assessment is not configured**, select **Enable** in the notice that prompts you to enable the vulnerability assessment express configuration, and confirm the change.
45
46
46
47
:::image type="content" source="media/sql-azure-vulnerability-assessment-enable/enable-express-vulnerability-assessment.png" alt-text="Screenshot of notice to enable the express vulnerability assessment configuration in the Defender for Cloud settings for a SQL server.":::
@@ -55,15 +56,15 @@ You can enable vulnerability assessment in two ways:
55
56
> [!IMPORTANT]
56
57
> Baselines and scan history are not migrated.
57
58
58
-
:::image type="content" source="media/sql-azure-vulnerability-assessment-enable/migrate-to-express-vulnerability-assessment.png" alt-text="Screenshot of notice to migrate from the classic to the express vulnerability assessment configuration in the Defender for Cloud settings for a SQL server.":::
59
+
:::image type="content" source="media/sql-azure-vulnerability-assessment-enable/migrate-to-express-vulnerability-assessment.png" alt-text="Screenshot of notice to migrate from classic to express vulnerability assessment configuration in the Defender for Cloud settings for a SQL server.":::
59
60
60
61
You can also select **Configure** and then select **Enable** in the Microsoft Defender for SQL settings:
61
-
62
+
62
63
:::image type="content" source="media/sql-azure-vulnerability-assessment-enable/migrate-to-express-vulnerability-assessment-configure.png" alt-text="Screenshot of notice to migrate from the classic to the express vulnerability assessment configuration in the Microsoft Defender for SQL settings.":::
63
64
64
65
Now you can go to the [**SQL databases should have vulnerability findings resolved**](https://ms.portal.azure.com/#view/Microsoft_Azure_Security_AzureDefenderForData/SqlVaServersRecommendationDetailsBlade/assessmentKey/82e20e14-edc5-4373-bfc4-f13121257c37) recommendation to see the vulnerabilities found in your databases. You can also run on-demand vulnerability assessment scans to see the current findings.
65
66
66
-
> [!NOTE]
67
+
> [!NOTE]
67
68
> Each database is randomly assigned a scan time on a set day of the week.
68
69
69
70
#### Enable express vulnerability assessment at scale
@@ -90,12 +91,12 @@ To enable vulnerability assessment with a storage account, use the classic confi
90
91
91
92
1. To configure vulnerability assessments to automatically run weekly scans to detect security misconfigurations, set **Periodic recurring scans** to **On**. The results are sent to the email addresses you provide in **Send scan reports to**. You can also send email notification to admins and subscription owners by enabling **Also send email notification to admins and subscription owners**.
92
93
93
-
> [!NOTE]
94
+
> [!NOTE]
94
95
> Each database is randomly assigned a scan time on a set day of the week. Email notifications are scheduled randomly per server on a set day of the week. The email notification report includes data from all recurring database scans that were executed during the preceding week (does not include on-demand scans).
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/sql-azure-vulnerability-assessment-manage.md
+6-10Lines changed: 6 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Manage vulnerability findings in your Azure SQL databases
3
-
description: Learn how to remediate software vulnerabilities and disable findings with the express configuration on Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics.
3
+
description: Learn how to remediate software vulnerabilities and disable findings with the express configuration.
4
4
author: dcurwin
5
5
ms.author: dacurwin
6
6
ms.date: 06/14/2023
@@ -32,7 +32,7 @@ If the vulnerability settings show the option to configure a storage account, yo
32
32
33
33
### View scan history
34
34
35
-
Select **Scan History** in the vulnerability assessment pane to view a history of all scans previously run on this database.
35
+
Select **Scan History** in the vulnerability assessment pane to view a history of all scans previously run on this database.
36
36
37
37
Express configuration doesn't store scan results if they're identical to previous scans. The scan time shown in the scan history is the time of the last scan where the scan results changed.
38
38
@@ -178,7 +178,7 @@ Here are several examples to how you can set up baselines using ARM templates:
178
178
}
179
179
```
180
180
181
-
#### Using PowerShell
181
+
#### Using PowerShell
182
182
183
183
Express configuration isn't supported in PowerShell cmdlets but you can use PowerShell to invoke the latest vulnerability assessment capabilities using REST API, for example:
184
184
@@ -211,7 +211,7 @@ To change an Azure SQL database from the express vulnerability assessment config
You might have to tweak `Update-AzSqlServerVulnerabilityAssessmentSetting` according to [Store Vulnerability Assessment scan results in a storage account accessible behind firewalls and VNets](/azure/azure-sql/database/sql-database-vulnerability-assessment-storage).
216
216
217
217
#### Errors
@@ -227,8 +227,8 @@ Possible causes:
227
227
- Switching to express configuration failed due to a database policy error. Database policies aren't visible in the Azure portal for Defender for SQL vulnerability assessment, so we check for them during the validation stage of switching to express configuration.
228
228
229
229
**Solution**: Disable all database policies for the relevant server and then try to switch to express configuration again.
230
-
- Consider using the [provided PowerShell script](powershell-sample-vulnerability-assessment-azure-sql.md) for assistance.
231
230
231
+
- Consider using the [provided PowerShell script](powershell-sample-vulnerability-assessment-azure-sql.md) for assistance.
- Disable findings from benchmarks that aren't of interest for a defined scope
249
249
250
250
> [!IMPORTANT]
251
+
>
251
252
> - To disable specific findings, you need permissions to edit a policy in Azure Policy. Learn more in [Azure RBAC permissions in Azure Policy](../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
252
253
> - Disabled findings will still be included in the weekly SQL vulnerability assessment email report.
253
254
> - Disabled rules are shown in the "Not applicable" section of the scan results.
@@ -308,8 +309,6 @@ You can use Azure PowerShell cmdlets to programmatically manage your vulnerabili
308
309
|[Update-AzSqlInstanceDatabaseVulnerabilityAssessmentSetting](/powershell/module/az.sql/Update-AzSqlInstanceDatabaseVulnerabilityAssessmentSetting)| Updates the vulnerability assessment settings of a managed database. |
309
310
|[Update-AzSqlInstanceVulnerabilityAssessmentSetting](/powershell/module/az.sql/Update-AzSqlInstanceVulnerabilityAssessmentSetting)| Updates the vulnerability assessment settings of a managed instance. |
310
311
311
-
312
-
313
312
For a script example, see [Azure SQL vulnerability assessment PowerShell support](/archive/blogs/sqlsecurity/azure-sql-vulnerability-assessment-now-with-powershell-support).
314
313
315
314
#### Azure CLI
@@ -409,7 +408,6 @@ To handle Boolean types as true/false, set the baseline result with binary input
409
408
}
410
409
```
411
410
412
-
413
411
---
414
412
415
413
## Next steps
@@ -418,5 +416,3 @@ To handle Boolean types as true/false, set the baseline result with binary input
418
416
- Learn more about [data discovery and classification](/azure/azure-sql/database/data-discovery-and-classification-overview).
419
417
- Learn more about [storing vulnerability assessment scan results in a storage account accessible behind firewalls and VNets](/azure/azure-sql/database/sql-database-vulnerability-assessment-storage).
420
418
- Check out [common questions](faq-defender-for-databases.yml) about Azure SQL databases.
0 commit comments