Dela via

Sql Vulnerability Assessment Scan Results - List

  • Referens
Tjänst:
Defender for Cloud
API-version:
2023-02-01-preview

Hämtar en lista över genomsökningsresultat för en enda genomsökningspost.

GET https://management.azure.com/{resourceId}/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/{scanId}/scanResults?workspaceId={workspaceId}&api-version=2023-02-01-preview

URI-parametrar

Name I Obligatorisk Typ Description
resourceId
 path True

string

Resursens identifierare.
scanId
 path True

string

Genomsöknings-ID:t. Skriv "senaste" för att hämta genomsökningsresultatet för den senaste genomsökningen.
api-version
 query True

string

API-versionen.
workspaceId
 query True

string

Arbetsytans ID.

Svar

Name Typ Description
200 OK

ScanResults

Returnerar listan över genomsökningsresultat.
Other Status Codes

CloudError

Felsvar som beskriver varför åtgärden misslyckades.

Säkerhet

azure_auth

Azure Active Directory OAuth2 Flow

Typ: oauth2
Flow: implicit
Auktoriseringswebbadress: https://login.microsoftonline.com/common/oauth2/authorize

Omfattningar

Name Description
user_impersonation personifiera ditt användarkonto

Exempel

List scan results
List scan results of the latest scan

List scan results

Exempelbegäran

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Exempelsvar

Statuskod:
200 
{
  "value": [
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2062",
      "name": "VA2062",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2062",
        "status": "NonFinding",
        "isTrimmed": false,
        "queryResults": [],
        "remediation": {
          "description": "Remove database firewall rules that grant excessive access",
          "scripts": [],
          "automated": false,
          "portalLink": ""
        },
        "baselineAdjustedResult": null,
        "ruleMetadata": {
          "ruleId": "VA2062",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Database-level firewall rules should not grant excessive access",
          "description": "The Azure SQL Database-level firewall helps protect your data by preventing all access to your database until you specify which IP addresses have permission. Database-level firewall rules grant access to the specific database based on the originating IP address of each request.\n\nDatabase-level firewall rules for master and user databases can only be created and managed through Transact-SQL (unlike server-level firewall rules which can also be created and managed using the Azure portal or PowerShell). For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that database-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process - to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected database.\n\nGranting excessive access using database firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your database. In fact, it's the equivalent of placing the database outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.database_firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    },
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
      "name": "VA2063",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2063",
        "status": "Finding",
        "isTrimmed": false,
        "queryResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "remediation": {
          "description": "Remove server firewall rules that grant excessive access",
          "scripts": [
            "EXECUTE sp_delete_firewall_rule N'Test';"
          ],
          "automated": false,
          "portalLink": "ReviewServerFirewallRules"
        },
        "baselineAdjustedResult": {
          "baseline": {
            "expectedResults": [
              [
                "Test",
                "0.0.0.0",
                "125.125.125.125"
              ]
            ],
            "updatedTime": "2020-02-04T12:49:41.027771+00:00"
          },
          "status": "NonFinding",
          "resultsNotInBaseline": [],
          "resultsOnlyInBaseline": []
        },
        "ruleMetadata": {
          "ruleId": "VA2063",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Server-level firewall rules should not grant excessive access",
          "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    }
  ]
}

List scan results of the latest scan

Exempelbegäran

GET https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/latest/scanResults?workspaceId=55555555-6666-7777-8888-999999999999&api-version=2023-02-01-preview

Exempelsvar

Statuskod:
200 
{
  "value": [
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2062",
      "name": "VA2062",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2062",
        "status": "NonFinding",
        "isTrimmed": false,
        "queryResults": [],
        "remediation": {
          "description": "Remove database firewall rules that grant excessive access",
          "scripts": [],
          "automated": false,
          "portalLink": ""
        },
        "baselineAdjustedResult": null,
        "ruleMetadata": {
          "ruleId": "VA2062",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Database-level firewall rules should not grant excessive access",
          "description": "The Azure SQL Database-level firewall helps protect your data by preventing all access to your database until you specify which IP addresses have permission. Database-level firewall rules grant access to the specific database based on the originating IP address of each request.\n\nDatabase-level firewall rules for master and user databases can only be created and managed through Transact-SQL (unlike server-level firewall rules which can also be created and managed using the Azure portal or PowerShell). For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that database-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process - to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected database.\n\nGranting excessive access using database firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your database. In fact, it's the equivalent of placing the database outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.database_firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    },
    {
      "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/Rg/providers/Microsoft.HybridCompute/machines/MyMachine/sqlServers/server1/databases/master/providers/Microsoft.Security/sqlVulnerabilityAssessments/default/scans/Scheduled-20200623/scanResults/VA2063",
      "name": "VA2063",
      "type": "Microsoft.Security/sqlVulnerabilityAssessments/scans/scanResults",
      "properties": {
        "ruleId": "VA2063",
        "status": "Finding",
        "isTrimmed": false,
        "queryResults": [
          [
            "Test",
            "0.0.0.0",
            "125.125.125.125"
          ]
        ],
        "remediation": {
          "description": "Remove server firewall rules that grant excessive access",
          "scripts": [
            "EXECUTE sp_delete_firewall_rule N'Test';"
          ],
          "automated": false,
          "portalLink": "ReviewServerFirewallRules"
        },
        "baselineAdjustedResult": {
          "baseline": {
            "expectedResults": [
              [
                "Test",
                "0.0.0.0",
                "125.125.125.125"
              ]
            ],
            "updatedTime": "2020-02-04T12:49:41.027771+00:00"
          },
          "status": "NonFinding",
          "resultsNotInBaseline": [],
          "resultsOnlyInBaseline": []
        },
        "ruleMetadata": {
          "ruleId": "VA2063",
          "severity": "High",
          "category": "SurfaceAreaReduction",
          "ruleType": "NegativeList",
          "title": "Server-level firewall rules should not grant excessive access",
          "description": "The Azure SQL server-level firewall helps protect your server by preventing all access to your databases until you specify which IP addresses have permission. Server-level firewall rules grant access to all databases that belong to the server based on the originating IP address of each request.\n\nServer-level firewall rules can only be created and managed through Transact-SQL as well as through the Azure portal or PowerShell. For more details please see: https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure\n\nThis check verifies that server-level firewall rules do not grant excessive access.",
          "rationale": "Often, administrators add rules that grant excessive access as part of a troubleshooting process � to eliminate the firewall as the source of a problem, they simply create a rule that allows all traffic to pass to the affected server.\n\nGranting excessive access using server firewall rules is a clear security concern, as it violates the principle of least privilege by allowing unnecessary access to your databases. In fact, it's the equivalent of placing the server outside of the firewall.",
          "queryCheck": {
            "query": "SELECT name\n    ,start_ip_address\n    ,end_ip_address\nFROM sys.firewall_rules\nWHERE ( \n        (CONVERT(bigint, parsename(end_ip_address, 1)) +\n         CONVERT(bigint, parsename(end_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(end_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(end_ip_address, 4)) * 16777216 ) \n        - \n        (CONVERT(bigint, parsename(start_ip_address, 1)) +\n         CONVERT(bigint, parsename(start_ip_address, 2)) * 256 + \n         CONVERT(bigint, parsename(start_ip_address, 3)) * 65536 + \n         CONVERT(bigint, parsename(start_ip_address, 4)) * 16777216 )\n      ) > 255;",
            "expectedResult": [],
            "columnNames": [
              "Firewall Rule Name",
              "Start Address",
              "End Address"
            ]
          },
          "benchmarkReferences": []
        }
      }
    }
  ]
}

Definitioner

Name Description
Baseline

Originalplansinformation.
BaselineAdjustedResult

Regelresultatet justerat med baslinje.
BenchmarkReference

Referensvärdet refererar till.
CloudError

Vanligt felsvar för alla Azure Resource Manager-API:er för att returnera felinformation för misslyckade åtgärder. (Detta följer även formatet för OData-felsvar.).
CloudErrorBody

Felinformationen.
ErrorAdditionalInfo

Ytterligare information om resurshanteringsfelet.
QueryCheck

Information om regelfrågan.
Remediation

Reparationsinformation.
RuleSeverity

Regelns allvarlighetsgrad.
RuleStatus

Status för regelresultat.
RuleType

Regeltypen.
ScanResult

Ett resultat av en sårbarhetsbedömningsgenomsökning för en enda regel.
ScanResultProperties

En resultategenskaper för sårbarhetsbedömningsgenomsökning för en enda regel.
ScanResults

En lista över genomsökningsresultat för sårbarhetsbedömning.
VaRule

information om metadata för sårbarhetsbedömningsregeln.

Baseline

Originalplansinformation.

Name Typ Description
expectedResults

string[]

Förväntade resultat.
updatedTime

string

Uppdateringstid för baslinje (UTC).

BaselineAdjustedResult

Regelresultatet justerat med baslinje.

Name Typ Description
baseline

Baseline

Originalplansinformation.
resultsNotInBaseline

string[]

Resultat som inte finns i baslinjen.
resultsOnlyInBaseline

string[]

Resultat som finns i baslinjen.
status

RuleStatus

Status för regelresultat.

BenchmarkReference

Referensvärdet refererar till.

Name Typ Description
benchmark

string

Referensnamnet.
reference

string

Referensvärdet.

CloudError

Vanligt felsvar för alla Azure Resource Manager-API:er för att returnera felinformation för misslyckade åtgärder. (Detta följer även formatet för OData-felsvar.).

Name Typ Description
error.additionalInfo

ErrorAdditionalInfo[]

Ytterligare information om felet.
error.code

string

Felkoden.
error.details

CloudErrorBody[]

Felinformationen.
error.message

string

Felmeddelandet.
error.target

string

Felmålet.

CloudErrorBody

Felinformationen.

Name Typ Description
additionalInfo

ErrorAdditionalInfo[]

Ytterligare information om felet.
code

string

Felkoden.
details

CloudErrorBody[]

Felinformationen.
message

string

Felmeddelandet.
target

string

Felmålet.

ErrorAdditionalInfo

Ytterligare information om resurshanteringsfelet.

Name Typ Description
info

object

Ytterligare information.
type

string

Ytterligare informationstyp.

QueryCheck

Information om regelfrågan.

Name Typ Description
columnNames

string[]

Kolumnnamn för förväntat resultat.
expectedResult

string[]

Förväntat resultat.
query

string

Regelfrågan.

Remediation

Reparationsinformation.

Name Typ Description
automated

boolean

Är reparation automatiserad.
description

string

Reparationsbeskrivning.
portalLink

string

Valfri länk för att åtgärda i Azure-portalen.
scripts

string[]

Reparationsskript.

RuleSeverity

Regelns allvarlighetsgrad.

Name Typ Description
High

string

Hög
Informational

string

Informativt
Low

string

Låg
Medium

string

Medium
Obsolete

string

Föråldrad

RuleStatus

Status för regelresultat.

Name Typ Description
Finding

string

Hitta
InternalError

string

InternalError
NonFinding

string

Icke-förfining

RuleType

Regeltypen.

Name Typ Description
BaselineExpected

string

BaselineExpected
Binary

string

Binär
NegativeList

string

Negativ lista
PositiveList

string

PositiveList

ScanResult

Ett resultat av en sårbarhetsbedömningsgenomsökning för en enda regel.

Name Typ Description
id

string

Resurs-ID
name

string

Resursnamn
properties

ScanResultProperties

En resultategenskaper för sårbarhetsbedömningsgenomsökning för en enda regel.
type

string

Resurstyp

ScanResultProperties

En resultategenskaper för sårbarhetsbedömningsgenomsökning för en enda regel.

Name Typ Description
baselineAdjustedResult

BaselineAdjustedResult

Regelresultatet justerat med baslinje.
isTrimmed

boolean

Anger om resultaten som anges här är trimmade.
queryResults

string[]

Resultatet av frågan som kördes.
remediation

Remediation

Reparationsinformation.
ruleId

string

Regel-ID:t.
ruleMetadata

VaRule

information om metadata för sårbarhetsbedömningsregeln.
status

RuleStatus

Status för regelresultat.

ScanResults

En lista över genomsökningsresultat för sårbarhetsbedömning.

Name Typ Description
value

ScanResult[]

Lista över genomsökningsresultat för sårbarhetsbedömning.

VaRule

information om metadata för sårbarhetsbedömningsregeln.

Name Typ Description
benchmarkReferences

BenchmarkReference[]

Referensvärdet refererar till.
category

string

Regelkategorin.
description

string

Regelbeskrivningen.
queryCheck

QueryCheck

Information om regelfrågan.
rationale

string

Regelmotivering.
ruleId

string

Regel-ID:t.
ruleType

RuleType

Regeltypen.
severity

RuleSeverity

Regelns allvarlighetsgrad.
title

string

Regelrubriken.