Merge pull request #153936 from DavidTrigano/patch-29

Update sql-vulnerability-assessment.md

Author: PRMerger15

articles/azure-sql/database/sql-vulnerability-assessment.md

@@ -11,7 +11,7 @@ ms.topic: how-to
 author: davidtrigano
 ms.author: datrigan
 ms.reviewer: vanto
-ms.date: 02/11/2021
+ms.date: 04/09/2021
 tags: azure-synapse
 ---
 # SQL vulnerability assessment helps you identify database vulnerabilities
@@ -120,6 +120,44 @@ Select **Export Scan Results** to create a downloadable Excel report of your sca
 
 Select **Scan History** in the vulnerability assessment pane to view a history of all scans previously run on this database. Select a particular scan in the list to view the detailed results of that scan.
 
+### Disable specific findings from Azure Security Center (preview)
+
+If you have an organizational need to ignore a finding, rather than remediate it, you can optionally disable it. Disabled findings don't impact your secure score or generate unwanted noise.
+
+When a finding matches the criteria you've defined in your disable rules, it won't appear in the list of findings. Typical scenarios include:
+
+- Disable findings with severity below medium
+- Disable findings that are non-patchable
+- Disable findings from benchmarks that aren't of interest for a defined scope
+
+> [!IMPORTANT]
+> To disable specific findings, you need permissions to edit a policy in Azure Policy. Learn more in [Azure RBAC permissions in Azure Policy](../../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
+
+To create a rule:
+
+1. From the recommendations detail page for **Vulnerability assessment findings on your SQL servers on machines should be remediated**, select **Disable rule**.
+
+1. Select the relevant scope.
+
+1. Define your criteria. You can use any of the following criteria: 
+    - Finding ID 
+    - Severity 
+    - Benchmarks 
+
+    :::image type="content" source="../../security-center/media/defender-for-sql-on-machines-vulnerability-assessment/disable-rule-vulnerability-findings-sql.png" alt-text="Create a disable rule for VA findings on SQL servers on machines":::
+
+1. Select **Apply rule**. Changes might take up to 24hrs to take effect.
+
+1. To view, override, or delete a rule: 
+
+    1. Select **Disable rule**.
+
+    1. From the scope list, subscriptions with active rules show as **Rule applied**.
+
+        :::image type="content" source="../../security-center/media/remediate-vulnerability-findings-vm/modify-rule.png" alt-text="Modify or delete an existing rule":::
+
+    1. To view or delete the rule, select the ellipsis menu ("...").
+
 ## Manage vulnerability assessments programmatically
 
 ### Using Azure PowerShell
@@ -241,4 +279,4 @@ To handle Boolean types as true/false, set the baseline result with binary input
 
 - Learn more about [Azure Defender for SQL](azure-defender-for-sql.md).
 - Learn more about [data discovery and classification](data-discovery-and-classification-overview.md).
-- Learn more about [Storing vulnerability assessment scan results in a storage account accessible behind firewalls and VNets](sql-database-vulnerability-assessment-storage.md).
+- Learn more about [Storing vulnerability assessment scan results in a storage account accessible behind firewalls and VNets](sql-database-vulnerability-assessment-storage.md).