Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline

Syntax

Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline
   [-ServerName] <String>
   [-DatabaseName] <String>
   [-InputObject <VulnerabilityAssessmentRuleBaselineModel>]
   -BaselineResult <String[][]>
   -RuleId <String>
   [-RuleAppliesToMaster]
   [-ResourceGroupName] <String>
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline cmdlet sets the vulnerability assessment rule baseline. As you review your assessment results, you can mark specific results as being an acceptable Baseline in your environment. The baseline is essentially a customization of how the results are reported. Results that match the baseline are considered as passing in subsequent scans. Once you have established your baseline security state, vulnerability assessment only reports on deviations from the baseline, and you can focus your attention on the relevant issues. Note that you need to run Enable-AzSqlServerAdvancedDataSecurity and Update-AzSqlServerVulnerabilityAssessmentSetting cmdlet as a prerequisite for using this cmdlets.

Examples

Example 1: Set a vulnerability assessment rule baseline

Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
             -ResourceGroupName "ahmadtesting" `
             -ServerName "ahmadpilotserver" `
             -DatabaseName "AhmadPilotDb" `
             -BaselineResult @(,@('dbo', 'db_owner', 'SQL_USER', 'INSTANCE')) `
             -RuleID 'VA2108'

Rule ID Rule Applies To Master Baseline Results
------- ---------------------- ----------------
VA2108  False                  {dbo;db_owner;SQL_USER;INSTANCE}

$arrayList = [System.Collections.ArrayList]::new()
$arrayList.Add(@('dbo', 'db_owner', 'SQL_USER', 'INSTANCE'))

Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
             -ResourceGroupName "demoresourcegroup" `
            -ServerName "demosqlser" `
            -DatabaseName "SQL_ERConnect" `
            -BaselineResult $arrayList `
            -RuleID 'VA2108'


Rule ID Rule Applies To Master Baseline Results                
------- ---------------------- ----------------                
VA2108  False                  {dbo;db_owner;SQL_USER;INSTANCE}

Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline  `
			-ResourceGroupName "ResourceGroup01" `
			-ServerName "Server01"  `
			-DatabaseName "Database01"  `
			-RuleId "VA2108" `
			-RuleAppliesToMaster `
			-BaselineResult @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

ResourceGroupName		: ResourceGroup01
ServerName	        	: Server01
DatabaseName	    	: Database01
RuleId		        	: VA2108
RuleAppliesToMaster    	: True
BaselineResult		    : @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

BaselineResult value is a composition of several sub arrays that described the T-SQL results that will be added to the baseline. Notice the special PS syntax for defining array of arrays with one result using an opening comma.
You may find the Scan results under the storage defined by the Set-AzSqlServerVulnerabilityAssessmentSettings cmdlet, under scans/{ServerName}/{DatabaseName}/scan_{ScanId}.json

Example 2: Set a vulnerability assessment rule baseline from a baseline object

Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
            -ResourceGroupName "ResourceGroup01" `
            -ServerName "Server01" `
            -DatabaseName "Database01" `
            -RuleId "VA2108" `
            -BaselineResult @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

Get-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
            -ResourceGroupName "ResourceGroup01" `
            -ServerName "Server01" `
            -DatabaseName "Database01" `
            -RuleId "VA2108" `
            |  Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
                -ResourceGroupName "ResourceGroup02" `
                -ServerName "Server02" `
                -DatabaseName "Database02"

ResourceGroupName		: ResourceGroup02
ServerName	        	: Server02
DatabaseName	    	: Database02
RuleId		        	: VA2108
RuleAppliesToMaster    	: False
BaselineResult		    : @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

Example 3: Set a vulnerability assessment rule baseline on all the databases under a server

Get-AzSqlDatabase -ResourceGroupName "ResourceGroup01" `
            -ServerName "Server01" `
            | Where-Object {$_.DatabaseName -ne "master"}  `
            | Set-AzSqlDatabaseVulnerabilityAssessmentRuleBaseline `
                -RuleId "VA2108" `
                -BaselineResult @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

ResourceGroupName		: ResourceGroup01
ServerName	        	: Server01
DatabaseName	    	: Database01
RuleId		        	: VA2108
RuleAppliesToMaster    	: False
BaselineResult		    : @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

ResourceGroupName		: ResourceGroup01
ServerName	        	: Server01
DatabaseName	    	: Database02
RuleId		        	: VA2108
RuleAppliesToMaster    	: False
BaselineResult		    : @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None')  , @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')

Parameters

-BaselineResult

-Confirm

-DatabaseName

-DefaultProfile

-InputObject

-ResourceGroupName

-RuleAppliesToMaster

-RuleId

-ServerName

-WhatIf

Inputs

String

VulnerabilityAssessmentRuleBaselineModel

String[][]

SwitchParameter

Outputs

DatabaseVulnerabilityAssessmentRuleBaselineModel