Share via

Sql Vulnerability Assessment Scan Results - Get

  • Reference
Service:
Defender for Cloud
API Version:
2023-02-01-preview

Gets the scan results of a single rule in a scan record.

GET https://management.azure.com/{resourceId}/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/{scanId}/scanResults/{scanResultId}?workspaceId={workspaceId}&api-version=2023-02-01-preview

URI Parameters

Name In Required Type Description
resourceId
 path True

string

The identifier of the resource.
scanId
 path True

string

The scan Id. Type 'latest' to get the scan results for the latest scan.
scanResultId
 path True

string

The rule Id of the results.
api-version
 query True

string

The api version.
workspaceId
 query True

string

The workspace Id.

Responses

Name Type Description
200 OK

ScanResult

Returns the scan results.
Other Status Codes

CloudError

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Get scan details of a scan record
Get scan details of the latest scan record

Get scan details of a scan record

Sample request

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Sample response

Status code:
200 
{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
  "name": "VA2063",
  "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
  "properties": {
    "ruleId": "VA2063",
    "status": "Finding",
    "isTrimmed": false,
    "queryResults": [
      [
        "Test",
        "0.0.0.0",
        "125.125.125.125"
      ]
    ],
    "remediation": {
      "description": "Remove server firewall rules that grant excessive access",
      "scripts": [
        "EXECUTE sp_delete_firewall_rule N'Test';"
      ],
      "automated": false,
      "portalLink": "ReviewServerFirewallRules"
    },
    "baselineAdjustedResult": {
      "baseline": {
        "expectedResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "updatedTime": "2020-02-04T12:49:41.027771+00:00"
      },
      "status": "NonFinding",
      "resultsNotInBaseline": [],
      "resultsOnlyInBaseline": []
    },
    "ruleMetadata": {
      "ruleId": "VA2063",
      "severity": "High",
      "category": "SurfaceAreaReduction",
      "ruleType": "NegativeList",
      "title": "Server-level firewall rules should not grant excessive access",
      "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
      "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
      "queryCheck": {
        "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
        "expectedResult": [],
        "columnNames": [
          "Firewall Rule Name",
          "Start Address",
          "End Address"
        ]
      },
      "benchmarkReferences": []
    }
  }
}

Get scan details of the latest scan record

Sample request

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/latest/scanResults/VA2063?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Sample response

Status code:
200 
{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
  "name": "VA2063",
  "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
  "properties": {
    "ruleId": "VA2063",
    "status": "Finding",
    "isTrimmed": false,
    "queryResults": [
      [
        "Test",
        "0.0.0.0",
        "125.125.125.125"
      ]
    ],
    "remediation": {
      "description": "Remove server firewall rules that grant excessive access",
      "scripts": [
        "EXECUTE sp_delete_firewall_rule N'Test';"
      ],
      "automated": false,
      "portalLink": "ReviewServerFirewallRules"
    },
    "baselineAdjustedResult": {
      "baseline": {
        "expectedResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "updatedTime": "2020-02-04T12:49:41.027771+00:00"
      },
      "status": "NonFinding",
      "resultsNotInBaseline": [],
      "resultsOnlyInBaseline": []
    },
    "ruleMetadata": {
      "ruleId": "VA2063",
      "severity": "High",
      "category": "SurfaceAreaReduction",
      "ruleType": "NegativeList",
      "title": "Server-level firewall rules should not grant excessive access",
      "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
      "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
      "queryCheck": {
        "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
        "expectedResult": [],
        "columnNames": [
          "Firewall Rule Name",
          "Start Address",
          "End Address"
        ]
      },
      "benchmarkReferences": []
    }
  }
}

Definitions

Name Description
Baseline

Baseline details.
BaselineAdjustedResult

The rule result adjusted with baseline.
BenchmarkReference

The benchmark references.
CloudError

Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).
CloudErrorBody

The error detail.
ErrorAdditionalInfo

The resource management error additional info.
QueryCheck

The rule query details.
Remediation

Remediation details.
RuleSeverity

The rule severity.
RuleStatus

The rule result status.
RuleType

The rule type.
ScanResult

A vulnerability assessment scan result for a single rule.
ScanResultProperties

A vulnerability assessment scan result properties for a single rule.
VaRule

vulnerability assessment rule metadata details.

Baseline

Baseline details.

Name Type Description
expectedResults

string[]

Expected results.
updatedTime

string

Baseline update time (UTC).

BaselineAdjustedResult

The rule result adjusted with baseline.

Name Type Description
baseline

Baseline

Baseline details.
resultsNotInBaseline

string[]

Results the are not in baseline.
resultsOnlyInBaseline

string[]

Results the are in baseline.
status

RuleStatus

The rule result status.

BenchmarkReference

The benchmark references.

Name Type Description
benchmark

string

The benchmark name.
reference

string

The benchmark reference.

CloudError

Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.).

Name Type Description
error.additionalInfo

ErrorAdditionalInfo[]

The error additional info.
error.code

string

The error code.
error.details

CloudErrorBody[]

The error details.
error.message

string

The error message.
error.target

string

The error target.

CloudErrorBody

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.
code

string

The error code.
details

CloudErrorBody[]

The error details.
message

string

The error message.
target

string

The error target.

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.
type

string

The additional info type.

QueryCheck

The rule query details.

Name Type Description
columnNames

string[]

Column names of expected result.
expectedResult

string[]

Expected result.
query

string

The rule query.

Remediation

Remediation details.

Name Type Description
automated

boolean

Is remediation automated.
description

string

Remediation description.
portalLink

string

Optional link to remediate in Azure Portal.
scripts

string[]

Remediation script.

RuleSeverity

The rule severity.

Name Type Description
High

string

High
Informational

string

Informational
Low

string

Low
Medium

string

Medium
Obsolete

string

Obsolete

RuleStatus

The rule result status.

Name Type Description
Finding

string

Finding
InternalError

string

InternalError
NonFinding

string

NonFinding

RuleType

The rule type.

Name Type Description
BaselineExpected

string

BaselineExpected
Binary

string

Binary
NegativeList

string

NegativeList
PositiveList

string

PositiveList

ScanResult

A vulnerability assessment scan result for a single rule.

Name Type Description
id

string

Resource Id
name

string

Resource name
properties

ScanResultProperties

A vulnerability assessment scan result properties for a single rule.
type

string

Resource type

ScanResultProperties

A vulnerability assessment scan result properties for a single rule.

Name Type Description
baselineAdjustedResult

BaselineAdjustedResult

The rule result adjusted with baseline.
isTrimmed

boolean

Indicated whether the results specified here are trimmed.
queryResults

string[]

The results of the query that was run.
remediation

Remediation

Remediation details.
ruleId

string

The rule Id.
ruleMetadata

VaRule

vulnerability assessment rule metadata details.
status

RuleStatus

The rule result status.

VaRule

vulnerability assessment rule metadata details.

Name Type Description
benchmarkReferences

BenchmarkReference[]

The benchmark references.
category

string

The rule category.
description

string

The rule description.
queryCheck

QueryCheck

The rule query details.
rationale

string

The rule rationale.
ruleId

string

The rule Id.
ruleType

RuleType

The rule type.
severity

RuleSeverity

The rule severity.
title

string

The rule title.