Prisma Cloud Remediation - Azure SQL Misconfiguration Deprecated Hidden

Deprecated. Use Prisma Cloud Remediation - Azure SQL Misconfiguration v2 instead. This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps. Remediation: - Azure SQL database auditing is disabled - Azure SQL Database with Auditing Retention less than 90 days - Azure Threat Detection on SQL databases is set to Off - Azure SQL Database with Threat Retention less than or equals to 90 days

Prisma Cloud by Palo Alto Networks · 12 tasks · 2 inputs · 0 outputs

Details

IDPrisma Cloud Remediation - Azure SQL Misconfiguration
From Version5.0.0
Tasks12

README

This playbook remediates Prisma Cloud Azure SQL alerts. It calls sub-playbooks that perform the actual remediation steps.

Remediation:

  • Azure SQL database auditing is disabled
  • Azure SQL Database with Auditing Retention less than 90 days
  • Azure Threat Detection on SQL databases is set to Off
  • Azure SQL Database with Threat Retention less than or equals to 90 days

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Prisma Cloud Remediation - Azure SQL Database Misconfiguration

Integrations

PrismaCloud v2

Scripts

IsIntegrationAvailable

Commands

  • redlock-dismiss-alerts
  • closeInvestigation

Playbook Inputs

Name Description Default Value Required
AutoRemediateAzureSQL Execute Azure SQL remediation automatically? no Optional
policyId Grab the Prisma Cloud policy ID. incident.labels.policy Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Prisma Cloud Remediation - Azure SQL Misconfiguration

Inputs

  • AutoRemediateAzureSQL — Execute Azure SQL remediation automatically?
  • policyId — Grab the Prisma Cloud policy Id.

Commands used

closeInvestigation redlock-dismiss-alerts

Flowchart

yes yes yes Yes database yes Start Start Is Azure SQL Management integration enabled? - IsIntegrationAvailable Is Azure SQL Management i... IsIntegrationAvailable Done Done Is there a policy to remediate? Is there a policy to reme... Update SQL automatically? Update SQL automatically? Auto remediate? Auto remediate? Execute playbook Execute playbook Manually update SQL Manually update SQL Close investigation - closeInvestigation Close investigation closeInvestigation Is Prisma Cloud v2 integration enabled? Is Prisma Cloud v2 integr... Dismiss Prisma Cloud alert - redlock-dismiss-alerts Dismiss Prisma Cloud alert redlock-dismiss-alerts Prisma Cloud Remediation - Azure SQL Database Misconfiguration - Prisma Cloud Remediation - Azure SQL Database Misconfiguration Prisma Cloud Remediation ... Prisma Cloud Remediation - Az...

Source

playbook-PCR_-_Azure_SQL_Misconfig.yml playbook-PCR_-_Azure_SQL_Misconfig_v2.yml playbook-PCR_-_Azure_SQL_Misconfig_v2_README.md
Download History Raw 
This playbook remediates Prisma Cloud Azure SQL alerts.  It calls sub-playbooks that perform the actual remediation steps.

Remediation:

- Azure SQL database auditing is disabled
- Azure SQL Database with Auditing Retention less than 90 days
- Azure Threat Detection on SQL databases is set to Off
- Azure SQL Database with Threat Retention less than or equals to 90 days

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

Prisma Cloud Remediation - Azure SQL Database Misconfiguration

### Integrations

PrismaCloud v2

### Scripts

IsIntegrationAvailable

### Commands

* prisma-cloud-alert-dismiss
* closeInvestigation

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| AutoRemediateAzureSQL | Execute Azure SQL remediation automatically? | no | Optional |
| policyId | Grab the Prisma Cloud policy ID. | incident.labels.policy | Optional |

## Playbook Outputs

---
There are no outputs for this playbook.

## Playbook Image

---

![Prisma Cloud Remediation - Azure SQL Misconfiguration v2](../doc_files/Prisma_Cloud_Remediation_-_Azure_SQL_Misconfiguration_v2.png)