< Back to rules searchAudit data for Azure SQL is retained for at least 90 days
Set up the azure.sql integration.
Description
SQL Server Audit Retention should be configured to be greater than 90 days.
Rationale
Use Audit Logs to check for anomalies and to get insight into suspected breaches or misuse of information and access.
From the console
- Go to SQL servers
- For each server instance
- Click on Auditing
- Select Storage Details
- Set Retention (days) setting greater than 90 days
- Select OK
- Select Save using Azure PowerShell.
From the commandline
- For each server, [set retention policy][3] for more than or equal to 90 days.
Set-AzSqlServerAuditing -State Enabled -ServerName "<server name>" -ResourceGroupName "<resource group name>" -StorageAccountName "abcd1234abcd1234abcd1234" -RetentionInDays <Number of Days to retain the audit logs, should be 90 days minimum>
Note: You can set the number of days to 0 for unlimited retention.
References
- [https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing][1]
- [https://learn.microsoft.com/en-us/powershell/module/az.sql/get-azsqlserveraudit?view=azps-9.2.0][2]
- [https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-6-configure-log-storage-retention][4]
[https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing][1]
[https://learn.microsoft.com/en-us/powershell/module/az.sql/get-azsqlserveraudit?view=azps-9.2.0][2]
[https://learn.microsoft.com/en-us/powershell/module/az.sql/set-azsqlserveraudit?view=azps-9.2.0][3]
[https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-logging-threat-detection#lt-6-configure-log-storage-retention][4]