SqlThreatDetection_Audit on all Azure SQL Virtual Machines

Question

I recently began seeing failures in my SQL Error logs relating to SQL Audits. We do not utilize SQL Audits in our environment so I began investigating.

I found that an audit named SqlThreatDetection_Audit was created and enabled on all of my IAAS SQL Servers. This is not a behavior I was expecting and I am trying to find the source of this change.

Starting on 07/01/2020 was the firsts creation of the Audit that I find on my servers. It has continued until today as the most recent was added.

And here is the error that started the investigation.

My research shows this might be related to something in Azure Security Center. However, no one in our Security, Networking or Infrastructure team has enabled anything that they feel would impact or cause this Audit to be enabled.

Answer 1

Hi GarryBargsley-1243,

You can set ‘Threat detection’ to OFF on SQL Servers. SQL Threat Detection provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities. Users will receive an alert upon suspicious database activities, potential vulnerabilities, and SQL injection attacks, as well as anomalous database access patterns. SQL Threat Detection alerts provide details of suspicious activity and recommend action on how to investigate and mitigate the threat.

Best regards,
Cathy

Answer 2

This is enabled from Azure Security Blade Pricing Tier:

Answer 3

I do not see this option in the Azure Portal for my IAAS SQL Servers. So I am still not clear on how this is getting enabled on my Azure VM's running SQL. I do have the SQLIaasExtension enabled and all servers registered under the Azure SQL category.

However, I need to see where to turn this off on my Azure VM's since I keep getting errors.

Answer 4

@CathyJi-MSFT , I am from MS responding to the customer.

Answer 5

Thanks for pointing me to the Security Center. However, only two of my subscriptions has the Standard Tier Pricing and the SQL servers on machines option enabled and shows 5 servers. The other subscription has the setting disabled.

But I have 75 servers with this audit enabled.