Skip to content

Commit baff8a3

Browse files
yaakoviyunyaakoviyun
committed
Updating Threat Detection types
1 parent f900814 commit baff8a3

File tree

9 files changed

+98
-73
lines changed

9 files changed

+98
-73
lines changed

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/ThreatDetectionTests.ps1

Lines changed: 25 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -57,35 +57,31 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
5757
{
5858
# Test
5959
Set-AzureRmSqlDatabaseAuditingPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount
60-
Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType "Successful_SQLi", "Attempted_SQLi"
60+
Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails "[email protected];[email protected]" -EmailAdmins $false -ExcludedDetectionType "Sql_Injection", "Sql_Injection_Vulnerability"
6161
$policy = Get-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
6262

6363
# Assert
6464
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
6565
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
6666
Assert-False {$policy.EmailAdmins}
6767
Assert-AreEqual $policy.ExcludedDetectionTypes.Length 2
68-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Successful_SQLi)}
69-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Attempted_SQLi)}
68+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection)}
69+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)}
7070

7171

7272
# Test
73-
Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "Successful_SQLi", "Attempted_SQLi", "Client_GEO_Anomaly", "Failed_Logins_Anomaly", "Failed_Queries_Anomaly", "Data_Extraction_Anomaly", "Data_Alteration_Anomaly"
73+
Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "Sql_Injection", "Sql_Injection_Vulnerability", "Access_Anomaly", "Usage_Anomaly"
7474
$policy = Get-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
7575

7676
# Assert
7777
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
7878
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
7979
Assert-False {$policy.EmailAdmins}
8080
Assert-AreEqual $policy.ExcludedDetectionTypes.Length 7
81-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Successful_SQLi)}
82-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Attempted_SQLi)}
83-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Client_GEO_Anomaly)}
84-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Failed_Logins_Anomaly)}
85-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Failed_Queries_Anomaly)}
86-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Data_Extraction_Anomaly)}
87-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Data_Alteration_Anomaly)}
88-
81+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection)}
82+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)}
83+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Access_Anomaly)}
84+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Usage_Anomaly)}
8985

9086
# Test
9187
Remove-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
@@ -96,13 +92,20 @@ function Test-ThreatDetectionDatabaseUpdatePolicy
9692
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
9793
Assert-False {$policy.EmailAdmins}
9894
Assert-AreEqual $policy.ExcludedDetectionTypes.Length 7
99-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Successful_SQLi)}
100-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Attempted_SQLi)}
101-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Client_GEO_Anomaly)}
102-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Failed_Logins_Anomaly)}
103-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Failed_Queries_Anomaly)}
104-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Data_Extraction_Anomaly)}
105-
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Data_Alteration_Anomaly)}
95+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection)}
96+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)}
97+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Access_Anomaly)}
98+
Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Usage_Anomaly)}
99+
100+
# Test
101+
Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -ExcludedDetectionType "None"
102+
$policy = Get-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
103+
104+
# Assert
105+
Assert-AreEqual $policy.ThreatDetectionState "Enabled"
106+
Assert-AreEqual $policy.NotificationRecipientsEmails "[email protected];[email protected]"
107+
Assert-False {$policy.EmailAdmins}
108+
Assert-AreEqual $policy.ExcludedDetectionTypes.Length 0
106109
}
107110
finally
108111
{
@@ -183,6 +186,9 @@ function Test-InvalidArgumentsThreatDetection
183186
# Check that EmailAdmins is not False and NotificationRecipientsEmails is not empty
184187
Assert-Throws {Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false}
185188
Assert-Throws {Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $false -NotificationRecipientsEmails ""}
189+
190+
# Check that ExcludedDetectionType doesn't hold None and any other type
191+
Assert-Throws {Set-AzureRmSqlDatabaseThreatDetectionPolicy -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -EmailAdmins $true -ExcludedDetectionType "None", "Sql_Injection_Vulnerability" }
186192
}
187193
finally
188194
{

‎src/ResourceManager/Sql/Commands.Sql/Common/SecurityConstants.cs

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -60,24 +60,18 @@ public class SecurityConstants
6060
public const string Disabled = "Disabled";
6161

6262
// Threat Detection disabled types:
63-
public const string Successful_SQLi = "Successful_SQLi";
64-
public const string Attempted_SQLi = "Attempted_SQLi";
65-
public const string Client_GEO_Anomaly = "Client_GEO_Anomaly";
66-
public const string Failed_Logins_Anomaly = "Failed_Logins_Anomaly";
67-
public const string Failed_Queries_Anomaly = "Failed_Queries_Anomaly";
68-
public const string Data_Extraction_Anomaly = "Data_Extraction_Anomaly";
69-
public const string Data_Alteration_Anomaly = "Data_Alteration_Anomaly";
63+
public const string Sql_Injection = "Sql_Injection";
64+
public const string Sql_Injection_Vulnerability = "Sql_Injection_Vulnerability";
65+
public const string Access_Anomaly = "Client_GEO_Anomaly";
66+
public const string Usage_Anomaly = "Usage_Anomaly";
7067

7168
public static readonly Dictionary<string, DetectionType> ExcludedDetectionToExcludedDetectionTypes = new Dictionary
7269
<string, DetectionType>
7370
{
74-
{Successful_SQLi, DetectionType.Successful_SQLi},
75-
{Attempted_SQLi, DetectionType.Attempted_SQLi},
76-
{Client_GEO_Anomaly, DetectionType.Client_GEO_Anomaly},
77-
{Failed_Logins_Anomaly, DetectionType.Failed_Logins_Anomaly},
78-
{Failed_Queries_Anomaly, DetectionType.Failed_Queries_Anomaly},
79-
{Data_Extraction_Anomaly, DetectionType.Data_Extraction_Anomaly},
80-
{Data_Alteration_Anomaly, DetectionType.Data_Alteration_Anomaly},
71+
{Sql_Injection, DetectionType.Sql_Injection},
72+
{Sql_Injection_Vulnerability, DetectionType.Sql_Injection_Vulnerability},
73+
{Access_Anomaly, DetectionType.Access_Anomaly},
74+
{Usage_Anomaly, DetectionType.Usage_Anomaly}
8175
};
8276

8377
// Masking functions

‎src/ResourceManager/Sql/Commands.Sql/Properties/Resources.Designer.cs

Lines changed: 10 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/ResourceManager/Sql/Commands.Sql/Properties/Resources.resx

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,4 +273,7 @@
273273
<data name="AuditingIsTurnedOff" xml:space="preserve">
274274
<value>In order to enable Threat Detection, please enable database auditing.</value>
275275
</data>
276+
<data name="InvalidExcludedDetectionTypeSet" xml:space="preserve">
277+
<value>Cannot use the '{0}' option with other excluded detection types.</value>
278+
</data>
276279
</root>

‎src/ResourceManager/Sql/Commands.Sql/Services/Util.cs

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,14 +78,41 @@ internal static string[] ProcessAuditEvents(string[] eventTypes)
7878
{
7979
if (eventTypes.Contains(SecurityConstants.All))
8080
{
81-
throw new Exception(string.Format(Microsoft.Azure.Commands.Sql.Properties.Resources.InvalidEventTypeSet, SecurityConstants.All));
81+
throw new Exception(string.Format(Properties.Resources.InvalidEventTypeSet, SecurityConstants.All));
8282
}
8383
if (eventTypes.Contains(SecurityConstants.None))
8484
{
85-
throw new Exception(string.Format(Microsoft.Azure.Commands.Sql.Properties.Resources.InvalidEventTypeSet, SecurityConstants.None));
85+
throw new Exception(string.Format(Properties.Resources.InvalidEventTypeSet, SecurityConstants.None));
8686
}
8787
}
8888
return eventTypes;
89-
}
89+
}
90+
91+
/// <summary>
92+
/// In cases where the user decided to use the shortcut NONE, this method sets the value of the ExcludedDetectionType property to reflect the correct values.
93+
/// </summary>
94+
internal static string[] ProcessExcludedDetectionTypes(string[] excludedDetectionTypes)
95+
{
96+
if (excludedDetectionTypes == null || excludedDetectionTypes.Length == 0)
97+
{
98+
return excludedDetectionTypes;
99+
}
100+
101+
if (excludedDetectionTypes.Length == 1)
102+
{
103+
if (excludedDetectionTypes[0] == SecurityConstants.None)
104+
{
105+
return new string[] { };
106+
}
107+
}
108+
else
109+
{
110+
if (excludedDetectionTypes.Contains(SecurityConstants.None))
111+
{
112+
throw new Exception(string.Format(Properties.Resources.InvalidExcludedDetectionTypeSet, SecurityConstants.None));
113+
}
114+
}
115+
return excludedDetectionTypes;
116+
}
90117
}
91118
}

‎src/ResourceManager/Sql/Commands.Sql/ThreatDetection/Cmdlet/SetAzureSqlDatabaseThreatDetection.cs

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
using System.Management.Automation;
1818
using System.Text.RegularExpressions;
1919
using Microsoft.Azure.Commands.Sql.Common;
20+
using Microsoft.Azure.Commands.Sql.Services;
2021
using Microsoft.Azure.Commands.Sql.ThreatDetection.Model;
2122

2223
namespace Microsoft.Azure.Commands.Sql.ThreatDetection.Cmdlet
@@ -50,7 +51,9 @@ public class SetAzureSqlDatabaseThreatDetection : SqlDatabaseThreatDetectionCmdl
5051
/// Gets or sets the names of the detection types to filter.
5152
/// </summary>
5253
[Parameter(Mandatory = false, ValueFromPipelineByPropertyName = true, HelpMessage = "Detection types to exclude")]
53-
[ValidateSet(SecurityConstants.Successful_SQLi, SecurityConstants.Attempted_SQLi, SecurityConstants.Client_GEO_Anomaly, SecurityConstants.Failed_Logins_Anomaly, SecurityConstants.Failed_Queries_Anomaly, SecurityConstants.Data_Extraction_Anomaly, SecurityConstants.Data_Alteration_Anomaly, IgnoreCase = false)]
54+
[ValidateSet(SecurityConstants.Sql_Injection,
55+
SecurityConstants.Sql_Injection_Vulnerability, SecurityConstants.Access_Anomaly,
56+
SecurityConstants.Usage_Anomaly, SecurityConstants.None, IgnoreCase = false)]
5457
public string[] ExcludedDetectionType { get; set; }
5558

5659
/// <summary>
@@ -79,6 +82,8 @@ protected override DatabaseThreatDetectionPolicyModel ApplyUserInputToModel(Data
7982
model.EmailAdmins = (bool)EmailAdmins;
8083
}
8184

85+
ExcludedDetectionType = Util.ProcessExcludedDetectionTypes(ExcludedDetectionType);
86+
8287
if (ExcludedDetectionType != null)
8388
{
8489
model.ExcludedDetectionTypes = ExcludedDetectionType.Select(s => SecurityConstants.ExcludedDetectionToExcludedDetectionTypes[s]).ToArray();

‎src/ResourceManager/Sql/Commands.Sql/ThreatDetection/Cmdlet/SqlDatabaseThreatDetectionCmdletBase.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
// ----------------------------------------------------------------------------------
1414

1515
using Microsoft.Azure.Commands.Sql.Common;
16-
using Microsoft.Azure.Commands.Sql.Auditing.Services;
1716
using Microsoft.Azure.Commands.Sql.ThreatDetection.Model;
1817
using Microsoft.Azure.Commands.Sql.ThreatDetection.Services;
1918
using Microsoft.Azure.Common.Authentication.Models;

‎src/ResourceManager/Sql/Commands.Sql/ThreatDetection/Model/BaseThreatDetectionPolicyModel.cs

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,10 @@ public enum ThreatDetectionStateType { Enabled, Disabled, New };
2424
/// </summary>
2525
public enum DetectionType
2626
{
27-
Successful_SQLi,
28-
Attempted_SQLi,
29-
Client_GEO_Anomaly,
30-
Failed_Logins_Anomaly,
31-
Failed_Queries_Anomaly,
32-
Data_Extraction_Anomaly,
33-
Data_Alteration_Anomaly
27+
Sql_Injection,
28+
Sql_Injection_Vulnerability,
29+
Access_Anomaly,
30+
Usage_Anomaly,
3431
};
3532

3633
/// <summary>

0 commit comments

Comments
 (0)