Create audit on azure SQL Database for delete command

user_18726247 0
Viewed 91

I´m trying to create a new audit on Azure SQL Database with command below:

Set-AzSqlDatabaseAudit -ResourceGroupName "NAME" -ServerName "SERVER" -DatabaseName "DATABASE" -AuditActionGroup "BATCH_COMPLETED_GROUP" -AuditAction "DELETE ON TABLE BY PUBLIC" -BlobStorageTargetState Enabled -StorageAccountResourceId "/..."

In audit log I noticed that all comandos are being registered, not just the delete commands in object desired and informed in cmdlet.

I can´t submit the comand withou option -AuditActionGroup "BATCH_COMPLETED_GROUP". I think the problem is here but I can´t submit without this part.

azure-sql-database azure audit
1 Answers

Please try auditing the action at the database level, that has worked for me.

Set-AzureRmSqlDatabaseAuditing -ResourceGroupName "resourceGroup"
 -ServerName "SQL Server Name" -DatabaseName "AdventureWorksLT"  
 -StorageAccountName "storageAccount" 
-AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP", "BATCH_COMPLETED_GROUP" 
 -AuditAction "DELETE ON database::[AdventureWorksLT] BY [public]"  
 -RetentionInDays 60
user_81841390
Related