Sdílet prostřednictvím

Sql Vulnerability Assessment Scan Results - List

  • Reference
Služba:
Defender for Cloud
Verze rozhraní API:
2023-02-01-preview

Získá seznam výsledků kontroly pro jeden záznam kontroly.

GET https://management.azure.com/{resourceId}/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/{scanId}/scanResults?workspaceId={workspaceId}&api-version=2023-02-01-preview

Parametry identifikátoru URI

Name V Vyžadováno Typ Description
resourceId
 path True

string

Identifikátor prostředku.
scanId
 path True

string

ID kontroly. Pokud chcete získat výsledky kontroly pro nejnovější kontrolu, zadejte "latest".
api-version
 query True

string

Verze rozhraní API.
workspaceId
 query True

string

ID pracovního prostoru.

Odpovědi

Name Typ Description
200 OK

ScanResults

Vrátí seznam výsledků kontroly.
Other Status Codes

CloudError

Chybová odpověď popisující, proč operace selhala.

Zabezpečení

azure_auth

Azure Active Directory OAuth2 Flow

Typ: oauth2
Tok: implicit
URL autorizace: https://login.microsoftonline.com/common/oauth2/authorize

Rozsahy

Name Description
user_impersonation zosobnění uživatelského účtu

Příklady

List scan results
List scan results of the latest scan

List scan results

Ukázkový požadavek

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Ukázková odpověď

Stavový kód:
200 
{
  "value": [
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2062",
      "name": "VA2062",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2062",
        "status": "NonFinding",
        "isTrimmed": false,
        "queryResults": [],
        "remediation": {
          "description": "Remove database firewall rules that grant excessive access",
          "scripts": [],
          "automated": false,
          "portalLink": ""
        },
        "baselineAdjustedResult": null,
        "ruleMetadata": {
          "ruleId": "VA2062",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Database-level firewall rules should not grant excessive access",
          "description": "The Azure SQL Database-level firewall helps protect your data by preventing all access to your database until you specify which IP addresses have permission. Database-level firewall rules grant access to the specific database based on the originating IP address of each request.\n\nDatabase-level firewall rules for master and user databases can only be created and managed through Transact-SQL (unlike server-level firewall rules which can also be created and managed using the Azure portal or PowerShell). For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that database-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process - to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected database.\n\nGranting excessive access using database firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your database. In fact, it's the equivalent of placing the database outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.database_firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    },
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
      "name": "VA2063",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2063",
        "status": "Finding",
        "isTrimmed": false,
        "queryResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "remediation": {
          "description": "Remove server firewall rules that grant excessive access",
          "scripts": [
            "EXECUTE sp_delete_firewall_rule N'Test';"
          ],
          "automated": false,
          "portalLink": "ReviewServerFirewallRules"
        },
        "baselineAdjustedResult": {
          "baseline": {
            "expectedResults": [
              [
                "Test",
                "0.0.0.0",
                "125.125.125.125"
              ]
            ],
            "updatedTime": "2020-02-04T12:49:41.027771+00:00"
          },
          "status": "NonFinding",
          "resultsNotInBaseline": [],
          "resultsOnlyInBaseline": []
        },
        "ruleMetadata": {
          "ruleId": "VA2063",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Server-level firewall rules should not grant excessive access",
          "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    }
  ]
}

List scan results of the latest scan

Ukázkový požadavek

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/latest/scanResults?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Ukázková odpověď

Stavový kód:
200 
{
  "value": [
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2062",
      "name": "VA2062",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2062",
        "status": "NonFinding",
        "isTrimmed": false,
        "queryResults": [],
        "remediation": {
          "description": "Remove database firewall rules that grant excessive access",
          "scripts": [],
          "automated": false,
          "portalLink": ""
        },
        "baselineAdjustedResult": null,
        "ruleMetadata": {
          "ruleId": "VA2062",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Database-level firewall rules should not grant excessive access",
          "description": "The Azure SQL Database-level firewall helps protect your data by preventing all access to your database until you specify which IP addresses have permission. Database-level firewall rules grant access to the specific database based on the originating IP address of each request.\n\nDatabase-level firewall rules for master and user databases can only be created and managed through Transact-SQL (unlike server-level firewall rules which can also be created and managed using the Azure portal or PowerShell). For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that database-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process - to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected database.\n\nGranting excessive access using database firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your database. In fact, it's the equivalent of placing the database outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.database_firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    },
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
      "name": "VA2063",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2063",
        "status": "Finding",
        "isTrimmed": false,
        "queryResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "remediation": {
          "description": "Remove server firewall rules that grant excessive access",
          "scripts": [
            "EXECUTE sp_delete_firewall_rule N'Test';"
          ],
          "automated": false,
          "portalLink": "ReviewServerFirewallRules"
        },
        "baselineAdjustedResult": {
          "baseline": {
            "expectedResults": [
              [
                "Test",
                "0.0.0.0",
                "125.125.125.125"
              ]
            ],
            "updatedTime": "2020-02-04T12:49:41.027771+00:00"
          },
          "status": "NonFinding",
          "resultsNotInBaseline": [],
          "resultsOnlyInBaseline": []
        },
        "ruleMetadata": {
          "ruleId": "VA2063",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Server-level firewall rules should not grant excessive access",
          "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    }
  ]
}

Definice

Name Description
Baseline

Podrobnosti směrného plánu
BaselineAdjustedResult

Výsledek pravidla upravený podle směrného plánu.
BenchmarkReference

Referenční informace o srovnávacích testech.
CloudError

Běžná chybová odpověď pro všechna rozhraní API Azure Resource Manageru pro vrácení podrobností o chybě pro neúspěšné operace (To se také řídí formátem odpovědi na chybu OData.)
CloudErrorBody

Podrobnosti o chybě.
ErrorAdditionalInfo

Další informace o chybě správy prostředků
QueryCheck

Podrobnosti dotazu pravidla.
Remediation

Podrobnosti o nápravě.
RuleSeverity

Závažnost pravidla.
RuleStatus

Stav výsledku pravidla.
RuleType

Typ pravidla.
ScanResult

Výsledek kontroly posouzení ohrožení zabezpečení pro jedno pravidlo
ScanResultProperties

Vlastnosti výsledků kontroly posouzení ohrožení zabezpečení pro jedno pravidlo
ScanResults

Seznam výsledků kontroly posouzení ohrožení zabezpečení
VaRule

podrobnosti o metadatech pravidel posouzení ohrožení zabezpečení

Baseline

Podrobnosti směrného plánu

Name Typ Description
expectedResults

string[]

Očekávané výsledky
updatedTime

string

Směrný čas aktualizace (UTC).

BaselineAdjustedResult

Výsledek pravidla upravený podle směrného plánu.

Name Typ Description
baseline

Baseline

Podrobnosti směrného plánu
resultsNotInBaseline

string[]

Výsledky nejsou ve směrném plánu.
resultsOnlyInBaseline

string[]

Výsledky jsou ve směrném plánu.
status

RuleStatus

Stav výsledku pravidla.

BenchmarkReference

Referenční informace o srovnávacích testech.

Name Typ Description
benchmark

string

Název srovnávacího testu.
reference

string

Referenční informace o srovnávacím testu.

CloudError

Běžná chybová odpověď pro všechna rozhraní API Azure Resource Manageru pro vrácení podrobností o chybě pro neúspěšné operace (To se také řídí formátem odpovědi na chybu OData.)

Name Typ Description
error.additionalInfo

ErrorAdditionalInfo[]

Další informace o chybě.
error.code

string

Kód chyby.
error.details

CloudErrorBody[]

Podrobnosti o chybě.
error.message

string

Chybová zpráva.
error.target

string

Cíl chyby.

CloudErrorBody

Podrobnosti o chybě.

Name Typ Description
additionalInfo

ErrorAdditionalInfo[]

Další informace o chybě.
code

string

Kód chyby.
details

CloudErrorBody[]

Podrobnosti o chybě.
message

string

Chybová zpráva.
target

string

Cíl chyby.

ErrorAdditionalInfo

Další informace o chybě správy prostředků

Name Typ Description
info

object

Další informace.
type

string

Další typ informací.

QueryCheck

Podrobnosti dotazu pravidla.

Name Typ Description
columnNames

string[]

Názvy sloupců očekávaného výsledku
expectedResult

string[]

Očekávaný výsledek
query

string

Dotaz pravidla.

Remediation

Podrobnosti o nápravě.

Name Typ Description
automated

boolean

Je náprava automatizovaná.
description

string

Popis nápravy
portalLink

string

Volitelný odkaz pro nápravu na webu Azure Portal
scripts

string[]

Skript pro nápravu

RuleSeverity

Závažnost pravidla.

Name Typ Description
High

string

Vysoko
Informational

string

Informační
Low

string

Nízký
Medium

string

Středně
Obsolete

string

Zastaralý

RuleStatus

Stav výsledku pravidla.

Name Typ Description
Finding

string

Nález
InternalError

string

InternalError
NonFinding

string

Nedefinování

RuleType

Typ pravidla.

Name Typ Description
BaselineExpected

string

BaselineExpected
Binary

string

Binární
NegativeList

string

NegativeList
PositiveList

string

PositiveList

ScanResult

Výsledek kontroly posouzení ohrožení zabezpečení pro jedno pravidlo

Name Typ Description
id

string

ID prostředku
name

string

Název prostředku
properties

ScanResultProperties

Vlastnosti výsledků kontroly posouzení ohrožení zabezpečení pro jedno pravidlo
type

string

Typ prostředku

ScanResultProperties

Vlastnosti výsledků kontroly posouzení ohrožení zabezpečení pro jedno pravidlo

Name Typ Description
baselineAdjustedResult

BaselineAdjustedResult

Výsledek pravidla upravený podle směrného plánu.
isTrimmed

boolean

Určuje, jestli jsou zde zadané výsledky oříznuté.
queryResults

string[]

Výsledky dotazu, který byl spuštěn.
remediation

Remediation

Podrobnosti o nápravě.
ruleId

string

ID pravidla.
ruleMetadata

VaRule

podrobnosti o metadatech pravidel posouzení ohrožení zabezpečení
status

RuleStatus

Stav výsledku pravidla.

ScanResults

Seznam výsledků kontroly posouzení ohrožení zabezpečení

Name Typ Description
value

ScanResult[]

Seznam výsledků kontroly posouzení ohrožení zabezpečení

VaRule

podrobnosti o metadatech pravidel posouzení ohrožení zabezpečení

Name Typ Description
benchmarkReferences

BenchmarkReference[]

Referenční informace o srovnávacích testech.
category

string

Kategorie pravidla.
description

string

Popis pravidla.
queryCheck

QueryCheck

Podrobnosti dotazu pravidla.
rationale

string

Pravidlo je důvod.
ruleId

string

ID pravidla.
ruleType

RuleType

Typ pravidla.
severity

RuleSeverity

Závažnost pravidla.
title

string

Název pravidla.