Share via


Managed Database Security Alert Policies - Create Or Update

Creates or updates a database's security alert policy.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/managedInstances/{managedInstanceName}/databases/{databaseName}/securityAlertPolicies/default?api-version=2023-08-01

URI Parameters

Name In Required Type Description
databaseName
path True

string

The name of the managed database for which the security alert policy is defined.

managedInstanceName
path True

string

The name of the managed instance.

resourceGroupName
path True

string

The name of the resource group that contains the resource. You can obtain this value from the Azure Resource Manager API or the portal.

securityAlertPolicyName
path True

SecurityAlertPolicyName

The name of the security alert policy.

subscriptionId
path True

string

The subscription ID that identifies an Azure subscription.

api-version
query True

string

The API version to use for the request.

Request Body

Name Required Type Description
properties.state True

SecurityAlertPolicyState

Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database.

properties.disabledAlerts

string[]

Specifies an array of alerts that are disabled. Allowed values are: Sql_Injection, Sql_Injection_Vulnerability, Access_Anomaly, Data_Exfiltration, Unsafe_Action, Brute_Force

properties.emailAccountAdmins

boolean

Specifies that the alert is sent to the account administrators.

properties.emailAddresses

string[]

Specifies an array of e-mail addresses to which the alert is sent.

properties.retentionDays

integer (int32)

Specifies the number of days to keep in the Threat Detection audit logs.

properties.storageAccountAccessKey

string

Specifies the identifier key of the Threat Detection audit storage account.

properties.storageEndpoint

string

Specifies the blob storage endpoint (e.g. https://MyAccount.blob.core.windows.net). This blob storage will hold all Threat Detection audit logs.

Responses

Name Type Description
200 OK

ManagedDatabaseSecurityAlertPolicy

Successfully set the managed database security alert policy.

201 Created

ManagedDatabaseSecurityAlertPolicy

Successfully created the managed database security alert policy.

Other Status Codes

ErrorResponse

*** Error Responses: ***

Examples

Update a database's threat detection policy with all parameters
Update a database's threat detection policy with minimal parameters

Update a database's threat detection policy with all parameters

Sample request

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb/securityAlertPolicies/default?api-version=2023-08-01

{
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": [
      "test@contoso.com",
      "user@contoso.com"
    ],
    "disabledAlerts": [
      "Sql_Injection",
      "Usage_Anomaly"
    ],
    "retentionDays": 6,
    "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

Sample response

{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb",
  "name": "default",
  "type": "Microsoft.Sql/managedInstances/databases/securityAlertPolicies",
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": [
      "test@contoso.com",
      "user@contoso.com"
    ],
    "disabledAlerts": [
      "Sql_Injection",
      "Usage_Anomaly"
    ],
    "retentionDays": 6,
    "storageAccountAccessKey": "",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}
{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb",
  "name": "default",
  "type": "Microsoft.Sql/managedInstances/databases/securityAlertPolicies",
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": [
      "test@contoso.com",
      "user@contoso.com"
    ],
    "disabledAlerts": [
      "Access_Anomaly",
      "Usage_Anomaly"
    ],
    "retentionDays": 6,
    "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

Update a database's threat detection policy with minimal parameters

Sample request

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb/securityAlertPolicies/default?api-version=2023-08-01

{
  "properties": {
    "state": "Enabled"
  }
}

Sample response

{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb",
  "name": "default",
  "type": "Microsoft.Sql/managedInstance/databases/securityAlertPolicies",
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": [],
    "disabledAlerts": [],
    "retentionDays": 0,
    "storageAccountAccessKey": "",
    "storageEndpoint": ""
  }
}
{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/securityalert-4799/providers/Microsoft.Sql/managedInstances/securityalert-6440/databases/testdb",
  "name": "default",
  "type": "Microsoft.Sql/managedInstance/databases/securityAlertPolicies",
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": [],
    "disabledAlerts": [],
    "retentionDays": 0,
    "storageAccountAccessKey": "",
    "storageEndpoint": ""
  }
}

Definitions

Name Description
ErrorAdditionalInfo

The resource management error additional info.

ErrorDetail

The error detail.

ErrorResponse

Error response

ManagedDatabaseSecurityAlertPolicy

A managed database security alert policy.

SecurityAlertPolicyName

The name of the security alert policy.

SecurityAlertPolicyState

Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database.

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorDetail

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorDetail[]

The error details.

message

string

The error message.

target

string

The error target.

ErrorResponse

Error response

Name Type Description
error

ErrorDetail

The error object.

ManagedDatabaseSecurityAlertPolicy

A managed database security alert policy.

Name Type Description
id

string

Resource ID.

name

string

Resource name.

properties.creationTime

string (date-time)

Specifies the UTC creation time of the policy.

properties.disabledAlerts

string[]

Specifies an array of alerts that are disabled. Allowed values are: Sql_Injection, Sql_Injection_Vulnerability, Access_Anomaly, Data_Exfiltration, Unsafe_Action, Brute_Force

properties.emailAccountAdmins

boolean

Specifies that the alert is sent to the account administrators.

properties.emailAddresses

string[]

Specifies an array of e-mail addresses to which the alert is sent.

properties.retentionDays

integer (int32)

Specifies the number of days to keep in the Threat Detection audit logs.

properties.state

SecurityAlertPolicyState

Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database.

properties.storageAccountAccessKey

string

Specifies the identifier key of the Threat Detection audit storage account.

properties.storageEndpoint

string

Specifies the blob storage endpoint (e.g. https://MyAccount.blob.core.windows.net). This blob storage will hold all Threat Detection audit logs.

type

string

Resource type.

SecurityAlertPolicyName

The name of the security alert policy.

Value Description
default

SecurityAlertPolicyState

Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database.

Value Description
New
Enabled
Disabled