Description

Detects Azure SQL Databases with insufficient audit log retention periods. SQL Database audit logs should be retained for at least 90 days to support security investigations and compliance requirements. Short retention periods may result in loss of critical audit data needed for security analysis.

Detection Strategy

• Checks the retention period configured for Azure SQL Database audit settings

• Reports a vulnerability if the audit log retention period is set to less than 90 days

• Evaluates each SQL database's extended audit configuration to ensure proper retention policies are in place