Documentation - V-276267

Title

Azure SQL Managed Instance must implement the capability to centrally review and analyze audit records from multiple components within the system using a service such as Azure Log Analytics.

Description

<VulnDiscussion>Automated mechanisms for centralized reviews and analyses include Security Information and Event Management products.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

Fix Text (Documentation Requirement)

Configure Azure SQL Managed Instance to implement the capability to centrally review and analyze audit records from multiple components within the system. One option is to use Log Analytics to query data in the Azure Monitor Logs store. Reference: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure?#set-up-auditing-for-your-server-to-event-hubs-or-azure-monitor-logs https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview?tabs=simple