Azure SQL Management

Microsoft Azure SQL Management Integration manages the Auditing and Threat Policies for Azure SQL.

IT Services · Azure SQL Management

Details

IDAzure SQL Management
ProviderMicrosoft
CategoryIT Services
From Version5.0.0
Docker Imagedemisto/crypto:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

Microsoft Azure SQL Management Integration manages the Auditing and Threat Policies for Azure SQL.
This integration was integrated and tested with version 2021-11-01 of Azure SQL Management

In order to connect to the AzureKubernetesServices using either Cortex XSOAR Azure App or the Self-Deployed Azure App, use one of the following methods:

  • Authorization Code Flow (Recommended).
  • Device Code Flow.
  • Azure Managed Identities
  • Client Credentials Flow.

Self-Deployed Application

To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.

The application must have user_impersonation permission and must allow public client flows (found under the Authentication section of the app). And must allow public client flows (found under the Authentication section of the app) for Device-code based authentications.

Authentication Using the User-Authentication Flow (recommended)

Follow these steps for a self-deployed configuration:

  1. To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, refer to the following Microsoft article steps 1-8.
  2. choose the ‘User Auth’ option in the Authentication Type parameter.
  3. Enter your Client/Application ID in the Application ID parameter.
  4. Enter your Client Secret in the Client Secret parameter.
  5. Enter your Tenant ID in the Tenant ID parameter.
  6. Enter your Application redirect URI in the Application redirect URI parameter.
  7. Save the instance.
  8. Run the !azure-sql-generate-login-url command in the War Room and follow the instruction.
  9. Run the !azure-sql-auth-test command - a ‘Success’ message should be printed to the War Room.

Authentication Using the Device Code Flow

Use the device code flow
to link Azure SQL Management with Cortex XSOAR.

Follow these steps for a self-deployed configuration:

  1. Fill in the required parameters.
  2. choose the ‘Device’ option in the user_auth_flow parameter.
  3. Run the !azure-sql-auth-start command.
  4. Follow the instructions that appear.
  5. Run the !azure-sql-auth-complete command.

Cortex XSOAR Azure App

In order to use the Cortex XSOAR Azure application, use the default application ID (8f9010bb-4efe-4cfa-a197-98a2694b7e0c).

You only need to fill in your subscription ID and resource group name. You can find your resource group and
subscription ID in the Azure Portal. For a more detailed explanation, visit this page.

Client Credentials Flow Authentication

Assign Azure roles using the Azure portal Microsoft article
Note: In the Select members section, assign the application you created earlier.
To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:

  1. In the Authentication Type field, select the Client Credentials option.
  2. In the Application ID field, enter your Client/Application ID.
  3. In the Tenant ID field, enter your Tenant ID .
  4. In the Client Secret field, enter your Client Secret.
  5. Click Test to validate the URLs, token, and connection
  6. Save the instance.

Testing authentication and connectivity

If you are using Device Code Flow or Authorization Code Flow, for testing your authentication and connectivity to the Azure SQL Management service run the !azure-sql-auth-test command.
If you are using Client Credentials Flow, click Test when you are configuring the instance.

Configure Azure SQL Management on Cortex XSOAR

In both options below, the device authorization grant flow is used.

In order to connect to the Azure SQL Management using either Cortex XSOAR Azure App or the Self-Deployed Azure App:

  1. Fill in the required parameters.

    Parameter Description Required
    Application ID   False
    Default Subscription ID Test button won’t work if not populated. This value can be overridden on a command basis. False
    Default Resource Group Name Test button won’t work if not populated. This value can be overridden on a command basis. False
    Authentication Type Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, Azure Managed Identities or Client Credentials Flow. True
    Tenant ID For authorization code mode or client credentials. False
    Client Secret For authorization code mode or client credentials. False
    Client Secret For authorization code mode or client credentials. False
    Application redirect URI For authorization code mode. False
    Authorization code for user-auth mode - received from the authorization step. False
    Azure Managed Identities Client ID The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM. False
    Azure AD endpoint Azure AD endpoint associated with a national cloud. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False

At the end of the process you’ll see a message that you’ve logged in successfully.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

azure-sql-auth-start

Run this command to start the authorization process and follow the instructions in the command results.

Base Command

azure-sql-auth-start

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command example


#### Human Readable Output

>### Authorization instructions
>
>1. To sign in, use a web browser to open the page [https://microsoft.com/devicelogin](https://microsoft.com/devicelogin)
>and enter the code **CODECODE** to authenticate.
>2. Run the **!azure-sql-auth-complete** command in the War Room.

### azure-sql-auth-complete

***
Run this command to complete the authorization process. Should be used after running the azure-sql-auth-start command.

#### Base Command

`azure-sql-auth-complete`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-nsg-auth-complete```

#### Human Readable Output

>✅ Authorization completed successfully.

### azure-sql-auth-reset

***
Run this command if for some reason you need to rerun the authentication process.

#### Base Command

`azure-sql-auth-reset`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command example

```!azure-sql-auth-reset```

#### Human Readable Output

>Authorization was reset successfully. You can now run ***!azure-sql-auth-start*** and ***!azure-sql-auth-complete***.

### azure-sql-auth-test

***
Tests the connectivity to the Azure SQL Management.

#### Base Command

`azure-sql-auth-test`

#### Input

There are no input arguments for this command.

#### Context Output

There is no context output for this command.

#### Command Example

```!azure-sql-auth-test```

#### Human Readable Output

>✅ Success!

### azure-sql-servers-list

***
Lists all the servers.

#### Base Command

`azure-sql-servers-list`

#### Input

| **Argument Name** | **Description**                                                                                                                                      | **Required** |
| --- |------------------------------------------------------------------------------------------------------------------------------------------------------| --- |
| limit | (Int) The maximum number of servers returned to the War Room. Default is 50.                                                                         | Optional |
| offset | Offset in the data set. Default is 0.                                                                                                                | Optional |
| subscription_id | Subscription ID. This value will override the instance param 'subscription_id'.                                                                      | Optional |
| resource_group_name | A comma-separated list of resource group names. This value will override the instance param 'resource_group_name'.                                   | Optional |
| list_by_resource_group | If true, returns the server lists that matches the given resource groups. Else, returns a list of all the servers. Possible values are: true, false. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| AzureSQL.Server | Unknown | Server list. |
| AzureSQL.Server.kind | String | Kind of server. |
| AzureSQL.Server.location | String | Server location. |
| AzureSQL.Server.tags | Unknown | Server tags. |
| AzureSQL.Server.id | String | Server ID. |
| AzureSQL.Server.name | String | Server name. |
| AzureSQL.Server.type | String | Server type. |
| AzureSQL.Server.administratorLogin | String | Username of the server administrator. |
| AzureSQL.Server.version | String | Server version. |
| AzureSQL.Server.state | String | Server state. |
| AzureSQL.Server.fullyQualifiedDomainName | Unknown | Fully qualified domain name of the server. |
| AzureSQL.Server.privateEndpointConnections | Unknown | List of private endpoint connections of the server. |
| AzureSQL.Server.publicNetworkAccess | Boolean | Whether the public endpoint access of the server is enabled. |
| AzureSQL.Server.restrictOutboundNetworkAccess | Unknown | Whether or not to restrict outbound network access for this server. Value is optional but if passed in, must be 'Enabled' or 'Disabled'. |

#### Command example

```!azure-sql-servers-list```

#### Context Example

```json
{
    "AzureSQL": {
        "Server": {
            "administratorLogin": "xsoaradmin",
            "fullyQualifiedDomainName": "sqlintegration.database.windows.net",
            "id": "/subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration",
            "kind": "v12.0",
            "location": "eastus",
            "name": "sqlintegration",
            "privateEndpointConnections": [],
            "publicNetworkAccess": "Enabled",
            "restrictOutboundNetworkAccess": "Disabled",
            "state": "Ready",
            "tags": {},
            "type": "Microsoft.Sql/servers",
            "version": "12.0"
        }
    }
}

Human Readable Output

Servers List

Administrator Login Fully Qualified Domain Name Id Kind Location Name Public Network Access State Type Version
xsoaradmin sqlintegration.database.windows.net /subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration v12.0 eastus sqlintegration Enabled Ready Microsoft.Sql/servers 12.0

azure-sql-db-list

Lists all of the databases for the server.

Base Command

azure-sql-db-list

Input

Argument Name Description Required
server_name Server name. Required
limit The maximum number of databases returned to the War Room. Default is 50. Optional
offset Offset in the data set. Default is 0. Optional
subscription_id Subscription ID. This value will override the instance param ‘subscription_id’. Optional
resource_group_name Resource group name. This value will override the instance param ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.DB Unknown All databases related to the server.
AzureSQL.DB.kind String Kind of database.
AzureSQL.DB.location String Database location.
AzureSQL.DB.id String Database ID.
AzureSQL.DB.name String Database name.
AzureSQL.DB.type String Database type.
AzureSQL.DB.managedBy String Resource that manages the database.
AzureSQL.DB.sku Unknown Database SKU.
AzureSQL.DB.catalogCollation String Collation of the catalog for the database.
AzureSQL.DB.collation String Database collation.
AzureSQL.DB.creationDate String Creation date of the database in ISO format.
AzureSQL.DB.currentServiceObjectiveName String Current service level objective name of the database.
AzureSQL.DB.currentSku Unknown Name, tier, and capacity of the SKU.
AzureSQL.DB.databaseID String Database ID.
AzureSQL.DB.defaultSecondaryLocation String Default secondary location of the database.
AzureSQL.DB.maxSizeBytes Number The maximum size of the database in bytes.
AzureSQL.DB.readReplicaCount Number The number of read-only secondary replicas of the database.
AzureSQL.DB.readScale String The read-only routing state. “Enabled” or “Disabled”.
AzureSQL.DB.requestedServiceObjectiveName String The requested service objective name of the database.
AzureSQL.DB.status String Database status.
AzureSQL.DB.storageAccountType String Database storage account type.
AzureSQL.DB.zoneRedundant Boolean Whether the database zone is redundant.
AzureSQL.DB.currentBackupStorageRedundancy Unknown The storage account type used to store backups for this database.
AzureSQL.DB.requestedBackupStorageRedundancy Unknown The storage account type to be used to store backups for this database.
AzureSQL.DB.maintenanceConfigurationId String Maintenance configuration ID assigned to the database. This configuration defines the period when the maintenance updates will occur.
AzureSQL.DB.isLedgerOn Boolean Whether or not this database is a ledger database, which means all tables in the database are ledger tables. The value of this property cannot be changed after the database has been created.
AzureSQL.DB.isInfraEncryptionEnabled Boolean Whether infra encryption is enabled for this database.

Command Example

!azure-sql-db-list server_name=sqlintegration

Context Example

{
    "AzureSQL": {
        "DB": [
            {
                "catalogCollation": "SQL_Latin1_General_CP1_CI_AS",
                "collation": "SQL_Latin1_General_CP1_CI_AS",
                "creationDate": "2020-12-15T14:31:06.663Z",
                "currentBackupStorageRedundancy": "currentBackupStorageRedundancy",
                "currentServiceObjectiveName": "S0",
                "currentSku": {
                    "capacity": 10,
                    "name": "Standard",
                    "tier": "Standard"
                },
                "databaseId": "databaseId",
                "defaultSecondaryLocation": "westus",
                "earliestRestoreDate": "2023-05-04T13:34:04.2874123Z",
                "id": "id",
                "isInfraEncryptionEnabled": false,
                "isLedgerOn": false,
                "kind": "v12.0,user",
                "location": "eastus",
                "maintenanceConfigurationId": "maintenanceConfigurationId",
                "maxSizeBytes": 268435456000,
                "name": "sql-integration-db",
                "readScale": "Disabled",
                "requestedBackupStorageRedundancy": "requestedBackupStorageRedundancy",
                "requestedServiceObjectiveName": "S0",
                "sku": {
                    "capacity": 10,
                    "name": "Standard",
                    "tier": "Standard"
                },
                "status": "Online",
                "tags": {},
                "type": "Microsoft.Sql/servers/databases",
                "zoneRedundant": false
            }
        ]
    }
}

Human Readable Output

Database List

Name Location Status Managed By
sql-integration-db eastus Online  

azure-sql-db-audit-policy-list

Gets the audit settings of the specified database.

Base Command

azure-sql-db-audit-policy-list

Input

Argument Name Description Required
server_name Server name. Required
db_name Database name. Required
limit The maximum number of database audit policies returned to the War Room. Default is 50. Optional
offset Offset in the data set. Default is 0. Optional
subscription_id Subscription ID. This value will override the instance param ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance param ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.DBAuditPolicy Unknown List of all database audit settings.
AzureSQL.DBAuditPolicy.kind String Kind of audit policy.
AzureSQL.DBAuditPolicy.id String Audit policy ID.
AzureSQL.DBAuditPolicy.name String Audit policy name.
AzureSQL.DBAuditPolicy.type String Resource type.
AzureSQL.DBAuditPolicy.isAzureMonitorTargetEnabled Boolean Whether audit events are sent to Azure Monitor. Possible values: “True” (Enabled) or “False” (Disabled).
AzureSQL.DBAuditPolicy.retentionDays Number Number of days to keep in the audit logs in the storage account.
AzureSQL.DBAuditPolicy.state String Policy state.
AzureSQL.DBAuditPolicy.storageAccountSubscriptionId String Storage subscription ID.
AzureSQL.DBAuditPolicy.databaseName String The name of the database that the audit policy is related to.
AzureSQL.DBAuditPolicy.serverName String The name of the server that the audit policy is related to.
AzureSQL.DBAuditPolicy.isManagedIdentityInUse Boolean Specifies whether Managed Identity is used to access blob storage.

Command Example

!azure-sql-db-audit-policy-list server_name=sqlintegration db_name=sql-integration-db

Context Example

{
    "AzureSQL": {
        "DBAuditPolicy": {
            "auditActionsAndGroups": [
                "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
                "FAILED_DATABASE_AUTHENTICATION_GROUP",
                "BATCH_COMPLETED_GROUP"
            ],
            "databaseName": "sql-db",
            "id": "/subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/auditingSettings/Default",
            "isAzureMonitorTargetEnabled": true,
            "isManagedIdentityInUse": false,
            "name": "Default",
            "retentionDays": 3,
            "serverName": "sql",
            "state": "Enabled",
            "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
            "storageEndpoint": "",
            "type": "Microsoft.Sql/servers/databases/auditingSettings"
        }
    }
}

Human Readable Output

Database Audit Settings for resource_group_name=’sql-integration’

Audit Actions And Groups Database Name Id Is Azure Monitor Target Enabled Is Managed Identity In Use Name Retention Days Server Name State Storage Account Subscription Id Type
SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,
FAILED_DATABASE_AUTHENTICATION_GROUP,
BATCH_COMPLETED_GROUP		 sql-integration-db /subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/auditingSettings/Default true false Default 3 sqlintegration Enabled 00000000-0000-0000-0000-000000000000 Microsoft.Sql/servers/databases/auditingSettings

azure-sql-db-threat-policy-get

Gets the threat detection policy of the specified database.

Base Command

azure-sql-db-threat-policy-get

Input

Argument Name Description Required
server_name Server name. Required
db_name Database name. Required
subscription_id Subscription ID. This value will override the instance param ‘subscription_id’. Optional
resource_group_name Resource group name. This value will override the instance param ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.DBThreatPolicy Unknown All threat policies related to the database.
AzureSQL.DBThreatPolicy.kind String Kind of threat policy.
AzureSQL.DBThreatPolicy.location String Threat policy location.
AzureSQL.DBThreatPolicy.id String Threat policy ID.
AzureSQL.DBThreatPolicy.name String Threat policy name.
AzureSQL.DBThreatPolicy.type String Threat policy type.
AzureSQL.DBThreatPolicy.state String Threat policy state.
AzureSQL.DBThreatPolicy.creationTime String Threat policy creation time.
AzureSQL.DBThreatPolicy.retentionDays Number Number of days to keep in the Threat Detection audit logs.
AzureSQL.DBThreatPolicy.storageAccountAccessKey String The identifier key of the Threat Detection audit storage account.
AzureSQL.DBThreatPolicy.storageEndpoint String Threat Detection audit storage account.
AzureSQL.DBThreatPolicy.emailAccountAdmins Boolean Email account administrators who the alert is sent to.
AzureSQL.DBThreatPolicy.emailAddresses String List of email addresses to which the alert is sent.
AzureSQL.DBThreatPolicy.disabledAlerts String List of alerts that are disabled, or an empty string if no alerts are disabled.
AzureSQL.DBThreatPolicy.useServerDefault Unknown Whether to use the default server policy.
AzureSQL.DBThreatPolicy.databaseName String The name of the database that the threat policy is related to.
AzureSQL.DBThreatPolicy.serverName String The name of server that the threat policy is related to.

Command example

!azure-sql-db-threat-policy-get server_name=sqlintegration db_name=sql-integration-db

Context Example

{
    "AzureSQL": {
        "DBThreatPolicy": {
            "creationTime": "2021-01-04T08:05:32.05Z",
            "databaseName": "sql-db",
            "disabledAlerts": [
                ""
            ],
            "emailAccountAdmins": false,
            "emailAddresses": [
                ""
            ],
            "id": "/subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/securityAlertPolicies/Default",
            "name": "Default",
            "retentionDays": 0,
            "serverName": "sql",
            "state": "Enabled",
            "storageAccountAccessKey": "",
            "storageEndpoint": "",
            "type": "Microsoft.Sql/servers/databases/securityAlertPolicies"
        }
    }
}

Human Readable Output

Database Threat Detection Policies

Creation Time Database Name Disabled Alerts Email Account Admins Email Addresses Id Name Retention Days Server Name State Type
2021-01-04T08:05:32.05Z sql-db   false   /subscriptions/0123456789/resourceGroups/sql/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/securityAlertPolicies/Default Default 0 sqlintegration Enabled Microsoft.Sql/servers/databases/securityAlertPolicies

azure-sql-db-audit-policy-create-update

Creates or updates the database’s auditing policy.

Base Command

azure-sql-db-audit-policy-create-update

Input

Argument Name Description Required
server_name Server name. Required
db_name Database name. Required
state Set the state of the policy. Possible values: “Enable” or “Disable”. When state is enabled, storage_endpoint or is_azure_monitor_target_enabled are required. Required
audit_actions_groups Comma-separated list of actions groups and actions to audit. For all possible values, see the integration documentation at https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15. Optional
is_azure_monitor_target_enabled Whether audit events are sent to the Azure Monitor. Possible values: “true” and “false”. Optional
is_storage_secondary_key_in_use Whether the storage Account Access Key value is the storage’s secondary key. Possible values: “true” and “false”. Optional
queue_delay_ms Time in milliseconds that can elapse before audit actions are forced to be processed. The default minimum value is 1000 (1 second). Optional
retention_days Number of days to keep the policy in the audit logs. Optional
storage_account_access_key Identifier key of the auditing storage account. Optional
storage_account_subscription_id Storage subscription ID. Optional
storage_endpoint Storage endpoint. If the value for the state argument is enabled, the value for the storage_endpoint or is_azure_monitor_target_enabled argument is required. Optional
subscription_id Subscription ID. This value will override the instance param ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance param ‘resource_group_name’. Optional
is_managed_identity_in_use Specifies whether Managed Identity is used to access blob storage. Possible values are: true, false. Optional

Context Output

Path Type Description
AzureSQL.DBAuditPolicy.kind String Kind of audit policy.
AzureSQL.DBAuditPolicy.id String Audit policy ID.
AzureSQL.DBAuditPolicy.name String Audit policy name.
AzureSQL.DBAuditPolicy.type String Resource type.
AzureSQL.DBAuditPolicy.isAzureMonitorTargetEnabled Boolean Whether audit events are sent to the Azure Monitor. The value is “True” (Enabled) or “False” (Disabled).
AzureSQL.DBAuditPolicy.retentionDays Number Number of days to keep in the audit logs in the storage account.
AzureSQL.DBAuditPolicy.state String Policy state.
AzureSQL.DBAuditPolicy.storageAccountSubscriptionId String Storage subscription ID.
AzureSQL.DBAuditPolicy.auditActionsAndGroups Unknown Audit actions and groups to audit.
AzureSQL.DBAuditPolicy.isStorageSecondaryKeyInUse Boolean Whether the storage_account_access_key value is the storage’s secondary key.
AzureSQL.DBAuditPolicy.queueDelayMs String Time in milliseconds that can elapse before audit actions are forced to be processed.
AzureSQL.DBAuditPolicy.storageAccountAccessKey String Identifier key of the auditing storage account.
AzureSQL.DBAuditPolicy.storageEndpoint String Storage endpoint.
AzureSQL.DBAuditPolicy.databaseName String The name of the database that the audit policy is related to.
AzureSQL.DBAuditPolicy.serverName String The name of server that the audit policy is related to.
AzureSQL.DBAuditPolicy.isManagedIdentityInUse Boolean Specifies whether Managed Identity is used to access blob storage.

Command example

!azure-sql-db-audit-policy-create-update server_name=sqlintegration db_name=sql-integration-db state=Enabled is_azure_monitor_target_enabled=true retention_days=3 queue_delay_ms=123

Context Example

{
    "AzureSQL": {
        "DBAuditPolicy": {
            "auditActionsAndGroups": [
                "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
                "FAILED_DATABASE_AUTHENTICATION_GROUP",
                "BATCH_COMPLETED_GROUP"
            ],
            "databaseName": "sql-db",
            "id": "/subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/auditingSettings/Default",
            "isAzureMonitorTargetEnabled": true,
            "isManagedIdentityInUse": false,
            "name": "Default",
            "queueDelayMs": 123,
            "retentionDays": 3,
            "serverName": "sql",
            "state": "Enabled",
            "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
            "type": "Microsoft.Sql/servers/databases/auditingSettings"
        }
    }
}

Human Readable Output

Create Or Update Database Auditing Settings for resource_group_name=’sql-integration’

Audit Actions And Groups Database Name Id Is Azure Monitor Target Enabled Is Managed Identity In Use Name Queue Delay Ms Retention Days Server Name State Storage Account Subscription Id Type
SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,
FAILED_DATABASE_AUTHENTICATION_GROUP,
BATCH_COMPLETED_GROUP		 sql-db /subscriptions/0123456789/resourceGroups/sql/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/auditingSettings/Default true false Default 123 3 sqlintegration Enabled 00000000-0000-0000-0000-000000000000 Microsoft.Sql/servers/databases/auditingSettings

azure-sql-db-threat-policy-create-update

Creates or updates the database’s threat detection policy.

Base Command

azure-sql-db-threat-policy-create-update

Input

Argument Name Description Required
server_name Server name. Required
db_name Database name. Required
state The state of the policy. Possible values: “Enabled” and “Disabled”. Required
retention_days Number of days to keep the policy in the audit logs. Optional
storage_account_access_key The identifier key of the threat detection audit storage account. Optional
storage_endpoint The blob storage endpoint. This blob storage will hold all Threat Detection audit logs. Optional
disabled_alerts Comma-separated list of alerts that are disabled. Possible values: “None”, “Sql_Injection”, “Sql_Injection_Vulnerability”, “Access_Anomaly”, “Data_Exfiltration”, and “Unsafe_Action”. Optional
email_addresses Comma-separated list of email addresses to which the alert is sent. Optional
email_account_admins Whether the alert is sent to the account administrators. Possible values: “true” and “false”. Optional
use_server_default Whether to use the default server policy. Possible values: “Enabled” and “Disabled”. Optional
subscription_id Subscription ID. This value will override the instance param ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance param ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.DBThreatPolicy.kind String Kind of threat policy.
AzureSQL.DBThreatPolicy.location String Threat policy location.
AzureSQL.DBThreatPolicy.id String Threat policy ID.
AzureSQL.DBThreatPolicy.name String Threat policy name.
AzureSQL.DBThreatPolicy.type String Threat policy type.
AzureSQL.DBThreatPolicy.state String Threat policy state.
AzureSQL.DBThreatPolicy.creationTime String Threat policy creation time.
AzureSQL.DBThreatPolicy.retentionDays Number Number of days to keep in the Threat Detection audit logs.
AzureSQL.DBThreatPolicy.storageAccountAccessKey String The identifier key of the Threat Detection audit storage account.
AzureSQL.DBThreatPolicy.storageEndpoint String Threat Detection audit storage account.
AzureSQL.DBThreatPolicy.emailAccountAdmins Boolean Email accounts administrators who the alert is sent to.
AzureSQL.DBThreatPolicy.emailAddresses String List of email addresses to which the alert is sent.
AzureSQL.DBThreatPolicy.disabledAlerts String List of alerts that are disabled, or an empty string if no alerts are disabled.
AzureSQL.DBThreatPolicy.useServerDefault Unknown Whether to use the default server policy.
AzureSQL.DBThreatPolicy.databaseName String The name of the database that the threat policy is related to.
AzureSQL.DBThreatPolicy.serverName String The name of the server that the threat policy is related to.

Command example

!azure-sql-db-threat-policy-create-update server_name=sqlintegration db_name=sql-integration-db state=Enabled disabled_alerts="Sql_Injection,Sql_Injection_Vulnerability" retention_days=5

Context Example

{
    "AzureSQL": {
        "DBThreatPolicy": {
            "creationTime": "0001-01-01T00:00:00Z",
            "databaseName": "sql-integration-db",
            "disabledAlerts": [
                "Sql_Injection",
                "Sql_Injection_Vulnerability"
            ],
            "emailAccountAdmins": false,
            "emailAddresses": [],
            "id": "/subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/securityAlertPolicies/Default",
            "name": "Default",
            "retentionDays": 5,
            "serverName": "sqlintegration",
            "state": "Enabled",
            "storageAccountAccessKey": "",
            "type": "Microsoft.Sql/servers/databases/securityAlertPolicies"
        }
    }
}

Human Readable Output

Create Or Update Database Threat Detection Policies for resource_group_name=’sql-integration’

Creation Time Database Name Disabled Alerts Email Account Admins Id Name Retention Days Server Name State Type
0001-01-01T00:00:00Z sql-integration-db Sql_Injection,
Sql_Injection_Vulnerability		 false /subscriptions/0123456789/resourceGroups/sql-integration/providers/Microsoft.Sql/servers/sqlintegration/databases/sql-integration-db/securityAlertPolicies/Default Default 5 sqlintegration Enabled Microsoft.Sql/servers/databases/securityAlertPolicies

azure-sql-generate-login-url

Generate the login url used for Authorization code flow.

Base Command

azure-sql-generate-login-url

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

Command Example

Human Readable Output

Subscription List

Subscription Id Name Tenant Id State
subscriptionId displayName tenantId Enabled

azure-sql-resource-group-list

Gets all the resource groups for a subscription.

Base Command

azure-sql-resource-group-list

Input

Argument Name Description Required
subscription_id A comma-separated list of subscription IDs. This value will override the instance param ‘subscription_id’. Optional
tag The tag and value that is attached to the resource group. Input should be “Tag Name:Tag Value”. Optional
limit The number of results to return. Default value is 50. Optional

Context Output

Path Type Description
AzureSQL.ResourceGroup.id String The ID of the resource group.
AzureSQL.ResourceGroup.name String The name of the resource group.
AzureSQL.ResourceGroup.type String The type of the resource group.
AzureSQL.ResourceGroup.location String The location of the resource group. It cannot be changed after the resource group has been created. It must be one of the supported Azure locations.
AzureSQL.ResourceGroup.properties String The resource group properties.
AzureSQL.ResourceGroup.tags String The tags attached to the resource group.

Command Example

azure-sql-resource-group-list tag="Name:name"

Context Example

{
    "AzureSQL": {
        "ResourceGroup":{
            "id": "id",
            "name": "name",
            "type": "Microsoft.Resources/resourceGroups",
            "location": "location",
            "tags": {
                "Name": "name"
            },
            "properties": {
                "provisioningState": "Succeeded"
            }
        }
    }
}

Human Readable Output

Resource Group List for subscriptionID

Name Location Tags Provisioning State
name location Name: name Succeeded

azure-sql-firewall-rule-list

Retrieves a list of firewall rules or a specific firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/read.

Base Command

azure-sql-firewall-rule-list

Input

Argument Name Description Required
server_name The name of the server. Required
firewall_rule_name The name of the firewall rule. If not provided, all firewall rules for the server are returned. Optional
subscription_id The subscription ID. This value will override the instance parameter ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance parameter ‘resource_group_name’. Optional
limit The maximum number of items to return. Applies only when listing all firewall rules (ignored when firewall_rule_name is provided). Default is 50. Optional
offset The offset in the data set. Applies only when listing all firewall rules (ignored when firewall_rule_name is provided). Default is 0. Optional

Context Output

Path Type Description
AzureSQL.FirewallRule.id String The resource ID.
AzureSQL.FirewallRule.name String The resource name.
AzureSQL.FirewallRule.type String The resource type.
AzureSQL.FirewallRule.properties.startIpAddress String The start IP address of the firewall rule.
AzureSQL.FirewallRule.properties.endIpAddress String The end IP address of the firewall rule.

azure-sql-firewall-rule-create-update

Creates or updates a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/write.

Base Command

azure-sql-firewall-rule-create-update

Input

Argument Name Description Required
server_name The name of the server. Required
firewall_rule_name The name of the firewall rule. Required
start_ip_address The start IP address of the firewall rule. Must be IPv4 format. Use value ‘0.0.0.0’ for all Azure-internal IP addresses. Required
end_ip_address The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value ‘0.0.0.0’ for all Azure-internal IP addresses. Required
subscription_id The subscription ID. This value will override the instance parameter ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance parameter ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.FirewallRule.id String The resource ID.
AzureSQL.FirewallRule.name String The resource name.
AzureSQL.FirewallRule.type String The resource type.
AzureSQL.FirewallRule.properties.startIpAddress String The start IP address of the firewall rule.
AzureSQL.FirewallRule.properties.endIpAddress String The end IP address of the firewall rule.

azure-sql-firewall-rule-delete

Deletes a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/delete.

Base Command

azure-sql-firewall-rule-delete

Input

Argument Name Description Required
server_name The name of the server. Required
firewall_rule_name The name of the firewall rule. Required
subscription_id The subscription ID. This value will override the instance parameter ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance parameter ‘resource_group_name’. Optional

Context Output

There is no context output for this command.

azure-sql-firewall-rule-replace

Replaces all firewall rules on the server. Required Permissions: Microsoft.Sql/servers/firewallRules/write.

Base Command

azure-sql-firewall-rule-replace

Input

Argument Name Description Required
server_name The name of the server. Required
firewall_rule_name The name of the firewall rule. Required unless ‘entry_id’ is provided. Optional
start_ip_address The start IP address of the firewall rule. Must be IPv4 format. Use value ‘0.0.0.0’ for all Azure-internal IP addresses. Required unless ‘entry_id’ is provided. Optional
end_ip_address The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value ‘0.0.0.0’ for all Azure-internal IP addresses. Required unless ‘entry_id’ is provided. Optional
entry_id The entry ID of a file containing the full request JSON (in the FirewallRuleList format). If provided, the ‘firewall_rule_name’, ‘start_ip_address’, and ‘end_ip_address’ arguments are ignored and must not be set. Optional
subscription_id The subscription ID. This value will override the instance parameter ‘subscription_id’. Optional
resource_group_name A comma-separated list of resource group names. This value will override the instance parameter ‘resource_group_name’. Optional

Context Output

Path Type Description
AzureSQL.FirewallRule.id String The resource ID.
AzureSQL.FirewallRule.name String The resource name.
AzureSQL.FirewallRule.type String The resource type.
AzureSQL.FirewallRule.properties.startIpAddress String The start IP address of the firewall rule.
AzureSQL.FirewallRule.properties.endIpAddress String The end IP address of the firewall rule.

Configuration parameters

  • app_id — Application ID
  • subscription_id — Default Subscription ID
  • resource_group_name — Default Resource Group Name
  • auth_type — Authentication Type (required)
  • tenant_id — Tenant ID
  • credentials — Client Secret
  • redirect_uri — Application redirect URI (for authorization code mode)
  • auth_code — Authorization code
  • managed_identities_client_id —
  • azure_ad_endpoint — Azure AD endpoint
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (17)

  • azure-sql-auth-complete

    Run this command to complete the authorization process. Should be used after running the azure-sql-auth-start command.

  • azure-sql-auth-reset

    Run this command if for some reason you need to rerun the authentication process.

  • azure-sql-auth-start

    Run this command to start the authorization process and follow the instructions in the command results.

  • azure-sql-auth-test

    Tests the connectivity to the Azure SQL Management.

  • azure-sql-db-audit-policy-create-update

    Creates or updates the database's auditing policy.

  • azure-sql-db-audit-policy-list

    Gets the audit settings of the specified database.

  • azure-sql-db-list

    Lists all of the databases for the server.

  • azure-sql-db-threat-policy-create-update

    Creates or updates the database's threat detection policy.

  • azure-sql-db-threat-policy-get

    Gets the threat detection policy of the specified database.

  • azure-sql-firewall-rule-create-update

    Creates or updates a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/write.

  • azure-sql-firewall-rule-delete

    Deletes a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/delete.

  • azure-sql-firewall-rule-list

    Retrieves a list of firewall rules or a specific firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/read.

  • azure-sql-firewall-rule-replace

    Replaces all firewall rules on the server. Required Permissions: Microsoft.Sql/servers/firewallRules/write.

  • azure-sql-generate-login-url

    Generate the login url used for Authorization code flow.

  • azure-sql-resource-group-list

    Gets all the resource groups for a subscription.

  • azure-sql-servers-list

    Lists all the servers.

  • azure-sql-subscriptions-list

    Gets all subscriptions for a tenant.

Source

AzureSQLManagement.py AzureSQLManagement_test.py AzureSQLManagement.yml AzureSQLManagement_description.md command_examples.txt
Download History Raw 
category: IT Services
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: Azure SQL Management
  version: -1
configuration:
- defaultvalue: 8f9010bb-4efe-4cfa-a197-98a2694b7e0c
  display: Application ID
  name: app_id
  type: 0
  section: Connect
  required: false
- display: Default Subscription ID
  name: subscription_id
  type: 0
  section: Connect
  additionalinfo: This value can be overridden on a command basis.
  required: false
- display: Default Resource Group Name
  name: resource_group_name
  type: 0
  section: Connect
  additionalinfo: This value can be overridden on a command basis.
  required: false
- additionalinfo: Type of authentication - can be Authorization Code Flow (recommended), Device Code Flow, Azure Managed Identities or Client Credentials Flow.
  display: Authentication Type
  name: auth_type
  required: true
  defaultvalue: Device Code
  options:
  - Authorization Code
  - Device Code
  - Azure Managed Identities
  - Client Credentials
  type: 15
  section: Connect
- display: Tenant ID
  name: tenant_id
  type: 0
  section: Connect
  required: false
- display: Client Secret
  displaypassword: Client Secret
  hiddenusername: true
  name: credentials
  type: 9
  section: Connect
  required: false
- display: Application redirect URI (for authorization code mode)
  name: redirect_uri
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Authorization code
  displaypassword: Authorization code
  additionalinfo: for user-auth mode - received from the authorization step. see Detailed Instructions (?) section
  hiddenusername: true
  name: auth_code
  type: 9
  section: Connect
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
- defaultvalue: https://login.microsoftonline.com
  display: Azure AD endpoint
  name: azure_ad_endpoint
  options:
  - https://login.microsoftonline.com
  - https://login.microsoftonline.us
  - https://login.microsoftonline.de
  - https://login.chinacloudapi.cn
  type: 15
  additionalinfo: Azure AD endpoint associated with a national cloud.
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: Microsoft Azure SQL Management Integration manages the Auditing and Threat Policies for Azure SQL.
display: Azure SQL Management
name: Azure SQL Management
script:
  commands:
  - description: Run this command to start the authorization process and follow the instructions in the command results.
    name: azure-sql-auth-start
  - description: Run this command to complete the authorization process. Should be used after running the azure-sql-auth-start command.
    name: azure-sql-auth-complete
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: azure-sql-auth-reset
  - description: Tests the connectivity to the Azure SQL Management.
    name: azure-sql-auth-test
  - arguments:
    - defaultValue: '50'
      description: (Int) The maximum number of servers returned to the War Room. Default is "50".
      name: limit
    - defaultValue: '0'
      description: Offset in the data set. Default is "0".
      name: offset
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: A comma-separated list of resource group names. This value will override the instance param 'resource_group_name'.
      isArray: true
      name: resource_group_name
    - description: If true, returns the server lists that match the given resource groups. Else, returns a list of all the servers. Default value is False.
      isArray: true
      name: list_by_resource_group
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Lists all the servers.
    name: azure-sql-servers-list
    outputs:
    - contextPath: AzureSQL.Server
      description: Server list.
      type: Unknown
    - contextPath: AzureSQL.Server.kind
      description: Kind of server.
      type: String
    - contextPath: AzureSQL.Server.location
      description: Server location.
      type: String
    - contextPath: AzureSQL.Server.tags
      description: Server tags.
      type: Unknown
    - contextPath: AzureSQL.Server.id
      description: Server ID.
      type: String
    - contextPath: AzureSQL.Server.name
      description: Server name.
      type: String
    - contextPath: AzureSQL.Server.type
      description: Server type.
      type: String
    - contextPath: AzureSQL.Server.administratorLogin
      description: Username of the server administrator.
      type: String
    - contextPath: AzureSQL.Server.version
      description: Server version.
      type: String
    - contextPath: AzureSQL.Server.state
      description: Server state.
      type: String
    - contextPath: AzureSQL.Server.fullyQualifiedDomainName
      description: Fully qualified domain name of the server.
      type: Unknown
    - contextPath: AzureSQL.Server.privateEndpointConnections
      description: List of private endpoint connections of the server.
      type: Unknown
    - contextPath: AzureSQL.Server.publicNetworkAccess
      description: Whether the public endpoint access of the server is enabled.
      type: Boolean
    - contextPath: AzureSQL.Server.restrictOutboundNetworkAccess
      description: Whether or not to restrict outbound network access for this server. Value is optional but if passed in, must be 'Enabled' or 'Disabled'.
      type: Unknown
  - arguments:
    - description: Server name.
      name: server_name
      required: true
    - defaultValue: '50'
      description: The maximum number of databases returned to the War Room. Default is "50".
      name: limit
    - defaultValue: '0'
      description: Offset in the data set. Default is "0'.
      name: offset
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: Resource group name. This value will override the instance param 'resource_group_name'.
      name: resource_group_name
    description: Lists all of the databases for the server.
    name: azure-sql-db-list
    outputs:
    - contextPath: AzureSQL.DB
      description: All databases related to the server.
      type: Unknown
    - contextPath: AzureSQL.DB.kind
      description: Kind of database.
      type: String
    - contextPath: AzureSQL.DB.location
      description: Database location.
      type: String
    - contextPath: AzureSQL.DB.id
      description: Database ID.
      type: String
    - contextPath: AzureSQL.DB.name
      description: Database name.
      type: String
    - contextPath: AzureSQL.DB.type
      description: Database type.
      type: String
    - contextPath: AzureSQL.DB.managedBy
      description: Resource that manages the database.
      type: String
    - contextPath: AzureSQL.DB.sku
      description: Database SKU.
      type: Unknown
    - contextPath: AzureSQL.DB.catalogCollation
      description: Collation of the catalog for the database.
      type: String
    - contextPath: AzureSQL.DB.collation
      description: Database collation.
      type: String
    - contextPath: AzureSQL.DB.creationDate
      description: Creation date of the database in ISO format.
      type: String
    - contextPath: AzureSQL.DB.currentServiceObjectiveName
      description: Current service level objective name of the database.
      type: String
    - contextPath: AzureSQL.DB.currentSku
      description: Name, tier, and capacity of the SKU.
      type: Unknown
    - contextPath: AzureSQL.DB.databaseID
      description: Database ID.
      type: String
    - contextPath: AzureSQL.DB.defaultSecondaryLocation
      description: Default secondary location of the database.
      type: String
    - contextPath: AzureSQL.DB.maxSizeBytes
      description: The maximum size of the database in bytes.
      type: Number
    - contextPath: AzureSQL.DB.readReplicaCount
      description: The number of read-only secondary replicas of the database.
      type: Number
    - contextPath: AzureSQL.DB.readScale
      description: The read-only routing state. "Enabled" or "Disabled".
      type: String
    - contextPath: AzureSQL.DB.requestedServiceObjectiveName
      description: The requested service objective name of the database.
      type: String
    - contextPath: AzureSQL.DB.status
      description: Database status.
      type: String
    - contextPath: AzureSQL.DB.storageAccountType
      description: Database storage account type.
      type: String
    - contextPath: AzureSQL.DB.zoneRedundant
      description: Whether the database zone is redundant.
      type: Boolean
    - contextPath: AzureSQL.DB.currentBackupStorageRedundancy
      description: The storage account type used to store backups for this database.
      type: Unknown
    - contextPath: AzureSQL.DB.requestedBackupStorageRedundancy
      description: The storage account type to be used to store backups for this database.
      type: Unknown
    - contextPath: AzureSQL.DB.maintenanceConfigurationId
      description: Maintenance configuration ID assigned to the database. This configuration defines the period when the maintenance updates will occur.
      type: String
    - contextPath: AzureSQL.DB.isLedgerOn
      description: Whether or not this database is a ledger database, which means all tables in the database are ledger tables. The value of this property cannot be changed after the database has been created.
      type: Boolean
    - contextPath: AzureSQL.DB.isInfraEncryptionEnabled
      description: Infra encryption is enabled for this database.
      type: Boolean
  - arguments:
    - description: Server name.
      name: server_name
      required: true
    - description: Database name.
      name: db_name
      required: true
    - defaultValue: '50'
      description: The maximum number of database audit policies returned to the War Room. Default is "50".
      name: limit
    - defaultValue: '0'
      description: Offset in the data set. Default is "0".
      name: offset
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: A comma-separated list of resource group names. This value will override the instance param 'resource_group_name'.
      isArray: true
      name: resource_group_name
    description: Gets the audit settings of the specified database.
    name: azure-sql-db-audit-policy-list
    outputs:
    - contextPath: AzureSQL.DBAuditPolicy
      description: List of all database audit settings.
      type: Unknown
    - contextPath: AzureSQL.DBAuditPolicy.kind
      description: Kind of audit policy.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.id
      description: Audit policy ID.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.name
      description: Audit policy name.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.type
      description: Resource type.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.isAzureMonitorTargetEnabled
      description: 'Whether audit events are sent to Azure Monitor. Possible values: "True" (Enabled) or "False" (Disabled).'
      type: Boolean
    - contextPath: AzureSQL.DBAuditPolicy.retentionDays
      description: Number of days to keep in the audit logs in the storage account.
      type: Number
    - contextPath: AzureSQL.DBAuditPolicy.state
      description: Policy state.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.storageAccountSubscriptionId
      description: Storage subscription ID.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.databaseName
      description: The name of the database that the audit policy is related to.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.serverName
      description: The name of the server that the audit policy is related to.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.isManagedIdentityInUse
      description: Specifies whether Managed Identity is used to access blob storage.
      type: Boolean
  - arguments:
    - description: Server name.
      name: server_name
      required: true
    - description: Database name.
      name: db_name
      required: true
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: Resource group name. This value will override the instance param 'resource_group_name'.
      name: resource_group_name
    description: Gets the threat detection policy of the specified database.
    name: azure-sql-db-threat-policy-get
    outputs:
    - contextPath: AzureSQL.DBThreatPolicy
      description: All threat policies related to the database.
      type: Unknown
    - contextPath: AzureSQL.DBThreatPolicy.kind
      description: Kind of threat policy.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.location
      description: Threat policy location.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.id
      description: Threat policy ID.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.name
      description: Threat policy name.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.type
      description: Threat policy type.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.state
      description: Threat policy state.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.creationTime
      description: Threat policy creation time.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.retentionDays
      description: Number of days to keep in the Threat Detection audit logs.
      type: Number
    - contextPath: AzureSQL.DBThreatPolicy.storageAccountAccessKey
      description: The identifier key of the Threat Detection audit storage account.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.storageEndpoint
      description: Threat Detection audit storage account.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.emailAccountAdmins
      description: Email account administrators who the alert is sent to.
      type: Boolean
    - contextPath: AzureSQL.DBThreatPolicy.emailAddresses
      description: List of email addresses to which the alert is sent.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.disabledAlerts
      description: List of alerts that are disabled, or an empty string if no alerts are disabled.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.useServerDefault
      description: Whether to use the default server policy.
      type: Unknown
    - contextPath: AzureSQL.DBThreatPolicy.databaseName
      description: The name of the database that the threat policy is related to.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.serverName
      description: The name of server that the threat policy is related to.
      type: String
  - arguments:
    - description: Server name.
      name: server_name
      required: true
    - description: Database name.
      name: db_name
      required: true
    - auto: PREDEFINED
      description: 'Set the state of the policy. Possible values: "Enable" or "Disable". When state is enabled, storage_endpoint or is_azure_monitor_target_enabled is required.'
      name: state
      predefined:
      - Enabled
      - Disabled
      required: true
    - description: Comma-separated list of actions groups and actions to audit. For all possible values, see the integration documentation at https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15.
      isArray: true
      name: audit_actions_groups
    - auto: PREDEFINED
      description: 'Whether audit events are sent to the Azure Monitor. Possible values: "true" and "false".'
      name: is_azure_monitor_target_enabled
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'Whether the storage Account Access Key value is the storage''s secondary key. Possible values: "true" and "false".'
      name: is_storage_secondary_key_in_use
      predefined:
      - 'true'
      - 'false'
    - description: Time in milliseconds that can elapse before audit actions are forced to be processed. The default minimum value is 1000 (1 second).
      name: queue_delay_ms
    - description: Number of days to keep the policy in the audit logs.
      name: retention_days
    - description: Identifier key of the auditing storage account.
      name: storage_account_access_key
    - description: Storage subscription ID.
      name: storage_account_subscription_id
    - description: Storage endpoint. If the value for the state argument is enabled, the value for the storage_endpoint or is_azure_monitor_target_enabled argument is required.
      name: storage_endpoint
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: A comma-separated list of resource group names. This value will override the instance param 'resource_group_name'.
      isArray: true
      name: resource_group_name
    - auto: PREDEFINED
      description: Specifies whether Managed Identity is used to access blob storage.
      name: is_managed_identity_in_use
      predefined:
      - 'true'
      - 'false'
    description: Creates or updates the database's auditing policy.
    name: azure-sql-db-audit-policy-create-update
    outputs:
    - contextPath: AzureSQL.DBAuditPolicy.kind
      description: Kind of audit policy.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.id
      description: Audit policy ID.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.name
      description: Audit policy name.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.type
      description: Resource type.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.isAzureMonitorTargetEnabled
      description: Whether audit events are sent to the Azure Monitor. The value is "True" (Enabled) or "False" (Disabled).
      type: Boolean
    - contextPath: AzureSQL.DBAuditPolicy.retentionDays
      description: Number of days to keep in the audit logs in the storage account.
      type: Number
    - contextPath: AzureSQL.DBAuditPolicy.state
      description: Policy state.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.storageAccountSubscriptionId
      description: Storage subscription ID.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.auditActionsAndGroups
      description: Audit actions and groups to audit.
      type: Unknown
    - contextPath: AzureSQL.DBAuditPolicy.isStorageSecondaryKeyInUse
      description: Whether the storage_account_access_key value is the storage's secondary key.
      type: Boolean
    - contextPath: AzureSQL.DBAuditPolicy.queueDelayMs
      description: Time in milliseconds that can elapse before audit actions are forced to be processed.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.storageAccountAccessKey
      description: Identifier key of the auditing storage account.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.storageEndpoint
      description: Storage endpoint.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.databaseName
      description: The name of the database that the audit policy is related to.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.serverName
      description: The name of server that the audit policy is related to.
      type: String
    - contextPath: AzureSQL.DBAuditPolicy.isManagedIdentityInUse
      description: Specifies whether Managed Identity is used to access blob storage.
      type: Boolean
  - arguments:
    - description: Server name.
      name: server_name
      required: true
    - description: Database name.
      name: db_name
      required: true
    - auto: PREDEFINED
      description: 'The state of the policy. Possible values: "Enabled" and "Disabled".'
      name: state
      predefined:
      - Enabled
      - Disabled
      required: true
    - description: Number of days to keep the policy in the audit logs.
      name: retention_days
    - description: The identifier key of the threat detection audit storage account.
      name: storage_account_access_key
    - description: The blob storage endpoint. This blob storage will hold all Threat Detection audit logs.
      name: storage_endpoint
    - description: 'Comma-separated list of alerts that are disabled. Possible values: "None", "Sql_Injection", "Sql_Injection_Vulnerability", "Access_Anomaly", "Data_Exfiltration", and "Unsafe_Action".'
      isArray: true
      name: disabled_alerts
    - description: Comma-separated list of email addresses to which the alert is sent.
      isArray: true
      name: email_addresses
    - auto: PREDEFINED
      description: 'Whether the alert is sent to the account administrators. Possible values: "true" and "false".'
      name: email_account_admins
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'Whether to use the default server policy. Possible values: "Enabled" and "Disabled".'
      name: use_server_default
      predefined:
      - Enabled
      - Disabled
    - description: Subscription ID. This value will override the instance param 'subscription_id'.
      name: subscription_id
    - description: A comma-separated list of resource group names. This value will override the instance param 'resource_group_name'.
      isArray: true
      name: resource_group_name
    description: Creates or updates the database's threat detection policy.
    name: azure-sql-db-threat-policy-create-update
    outputs:
    - contextPath: AzureSQL.DBThreatPolicy.kind
      description: Kind of threat policy.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.location
      description: Threat policy location.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.id
      description: Threat policy ID.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.name
      description: Threat policy name.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.type
      description: Threat policy type.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.state
      description: Threat policy state.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.creationTime
      description: Threat policy creation time.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.retentionDays
      description: Number of days to keep in the Threat Detection audit logs.
      type: Number
    - contextPath: AzureSQL.DBThreatPolicy.storageAccountAccessKey
      description: The identifier key of the Threat Detection audit storage account.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.storageEndpoint
      description: Threat Detection audit storage account.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.emailAccountAdmins
      description: Email accounts administrators who the alert is sent to.
      type: Boolean
    - contextPath: AzureSQL.DBThreatPolicy.emailAddresses
      description: List of email addresses to which the alert is sent.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.disabledAlerts
      description: List of alerts that are disabled, or an empty string if no alerts are disabled.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.useServerDefault
      description: Whether to use the default server policy.
      type: Unknown
    - contextPath: AzureSQL.DBThreatPolicy.databaseName
      description: The name of the database that the threat policy is related to.
      type: String
    - contextPath: AzureSQL.DBThreatPolicy.serverName
      description: The name of server that the threat policy is related to.
      type: String
  - description: Generate the login url used for Authorization code flow.
    name: azure-sql-generate-login-url
    arguments: []
  - arguments: []
    description: Gets all subscriptions for a tenant.
    name: azure-sql-subscriptions-list
    outputs:
    - contextPath: AzureSQL.Subscription.id
      description: The fully qualified ID for the subscription.
      type: String
    - contextPath: AzureSQL.Subscription.authorizationSource
      description: The authorization source of the request. Valid values are one or more combinations of Legacy, RoleBased, Bypassed, Direct and Management. For example, 'Legacy, RoleBased'.
      type: String
    - contextPath: AzureSQL.Subscription.managedByTenants
      description: An array containing the tenants managing the subscription.
      type: Unknown
    - contextPath: AzureSQL.Subscription.subscriptionId
      description: The subscription ID.
      type: String
    - contextPath: AzureSQL.Subscription.tenantId
      description: The subscription tenant ID.
      type: String
    - contextPath: AzureSQL.Subscription.displayName
      description: The subscription display name.
      type: String
    - contextPath: AzureSQL.Subscription.state
      description: The subscription state. Possible values are Enabled, Warned, PastDue, Disabled, and Deleted.
      type: String
    - contextPath: AzureSQL.Subscription.subscriptionPolicies.locationPlacementId
      description: The subscription location placement ID. The ID indicates which regions are visible for a subscription. For example, a subscription with a location placement ID of Public_2014-09-01 has access to Azure public regions.
      type: String
    - contextPath: AzureSQL.Subscription.subscriptionPolicies.quotaId
      description: The subscription quota ID.
      type: String
    - contextPath: AzureSQL.Subscription.subscriptionPolicies.spendingLimit
      description: The subscription spending limit.
      type: String
  - arguments:
    - description: A comma-separated list of subscription ID.s This value will override the instance param 'subscription_id'.
      isArray: true
      name: subscription_id
    - description: The tag and value that is attached to the resource group. Input should be “Tag Name:Tag Value”.
      name: tag
    - description: The number of results to return. Default value is 50.
      name: limit
    description: Gets all the resource groups for a subscription.
    name: azure-sql-resource-group-list
    outputs:
    - contextPath: AzureSQL.ResourceGroup.id
      description: The ID of the resource group.
      type: String
    - contextPath: AzureSQL.ResourceGroup.name
      description: The name of the resource group.
      type: String
    - contextPath: AzureSQL.ResourceGroup.type
      description: The type of the resource group.
      type: String
    - contextPath: AzureSQL.ResourceGroup.location
      description: The location of the resource group. It cannot be changed after the resource group has been created. It must be one of the supported Azure locations.
      type: String
    - contextPath: AzureSQL.ResourceGroup.properties
      description: The resource group properties.
      type: String
    - contextPath: AzureSQL.ResourceGroup.tags
      description: The tags attached to the resource group.
      type: String
  - name: azure-sql-firewall-rule-list
    description: "Retrieves a list of firewall rules or a specific firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/read."
    arguments:
    - name: server_name
      description: The name of the server.
      required: true
    - name: firewall_rule_name
      description: The name of the firewall rule. If not provided, all firewall rules for the server are returned.
    - name: subscription_id
      description: The subscription ID. This value will override the instance parameter 'subscription_id'.
    - name: resource_group_name
      description: A comma-separated list of resource group names. This value will override the instance parameter 'resource_group_name'.
      isArray: true
    - name: limit
      description: The maximum number of items to return. Applies only when listing all firewall rules (ignored when firewall_rule_name is provided).
      defaultValue: '50'
    - name: offset
      description: The offset in the data set. Applies only when listing all firewall rules (ignored when firewall_rule_name is provided).
      defaultValue: '0'
    outputs:
    - contextPath: AzureSQL.FirewallRule.id
      description: The resource ID.
      type: String
    - contextPath: AzureSQL.FirewallRule.name
      description: The resource name.
      type: String
    - contextPath: AzureSQL.FirewallRule.type
      description: The resource type.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.startIpAddress
      description: The start IP address of the firewall rule.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.endIpAddress
      description: The end IP address of the firewall rule.
      type: String
  - name: azure-sql-firewall-rule-create-update
    description: "Creates or updates a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/write."
    arguments:
    - name: server_name
      description: The name of the server.
      required: true
    - name: firewall_rule_name
      description: The name of the firewall rule.
      required: true
    - name: start_ip_address
      description: "The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses."
      required: true
    - name: end_ip_address
      description: "The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses."
      required: true
    - name: subscription_id
      description: The subscription ID. This value will override the instance parameter 'subscription_id'.
    - name: resource_group_name
      description: A comma-separated list of resource group names. This value will override the instance parameter 'resource_group_name'.
      isArray: true
    outputs:
    - contextPath: AzureSQL.FirewallRule.id
      description: The resource ID.
      type: String
    - contextPath: AzureSQL.FirewallRule.name
      description: The resource name.
      type: String
    - contextPath: AzureSQL.FirewallRule.type
      description: The resource type.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.startIpAddress
      description: The start IP address of the firewall rule.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.endIpAddress
      description: The end IP address of the firewall rule.
      type: String
  - name: azure-sql-firewall-rule-delete
    description: "Deletes a firewall rule. Required Permissions: Microsoft.Sql/servers/firewallRules/delete."
    arguments:
    - name: server_name
      description: The name of the server.
      required: true
    - name: firewall_rule_name
      description: The name of the firewall rule.
      required: true
    - name: subscription_id
      description: The subscription ID. This value will override the instance parameter 'subscription_id'.
    - name: resource_group_name
      description: A comma-separated list of resource group names. This value will override the instance parameter 'resource_group_name'.
      isArray: true
  - name: azure-sql-firewall-rule-replace
    description: "Replaces all firewall rules on the server. Required Permissions: Microsoft.Sql/servers/firewallRules/write."
    arguments:
    - name: server_name
      description: The name of the server.
      required: true
    - name: firewall_rule_name
      description: The name of the firewall rule. Required unless 'entry_id' is provided.
    - name: start_ip_address
      description: "The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses. Required unless 'entry_id' is provided."
    - name: end_ip_address
      description: "The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses. Required unless 'entry_id' is provided."
    - name: entry_id
      description: "The entry ID of a file containing the full request JSON (in the FirewallRuleList format). If provided, the 'firewall_rule_name', 'start_ip_address', and 'end_ip_address' arguments are ignored and must not be set."
    - name: subscription_id
      description: The subscription ID. This value will override the instance parameter 'subscription_id'.
    - name: resource_group_name
      description: A comma-separated list of resource group names. This value will override the instance parameter 'resource_group_name'.
      isArray: true
    outputs:
    - contextPath: AzureSQL.FirewallRule.id
      description: The resource ID.
      type: String
    - contextPath: AzureSQL.FirewallRule.name
      description: The resource name.
      type: String
    - contextPath: AzureSQL.FirewallRule.type
      description: The resource type.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.startIpAddress
      description: The start IP address of the firewall rule.
      type: String
    - contextPath: AzureSQL.FirewallRule.properties.endIpAddress
      description: The end IP address of the firewall rule.
      type: String
  dockerimage: demisto/crypto:1.0.0.10120494
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Azure SQL - Test
fromversion: 5.0.0