DISA_STIG_MSSQL_2012_Instance-DB_v1r20.audit from DISA Microsoft SQL Server Instance 2012 v1r20 STIG

SQL2-00-000100 - The number of concurrent SQL Server sessions for each system account must be limited.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-53793r4_rule

STIG-ID|SQL2-00-000100

Vuln-ID|V-41311

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 14'

800-53|AC-3(10)

CCI|CCI-002186

Rule-ID|SV-53789r4_rule

STIG-ID|SQL2-00-001600

Vuln-ID|V-41307

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 15'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 18'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 20'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 102'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 103'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 104'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 105'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 106'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 107'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 108'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 109'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 110'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 111'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 112'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 113'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 115'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 116'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 117'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 118'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 128'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 129'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 130'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 131'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 132'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 133'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 134'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 135'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 152'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 153'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 170'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 171'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 172'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 173'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 175'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 176'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 177'

SQL2-00-001600 - SQL Server must ensure that remote sessions that access an organization-defined list of security functions and security-relevant information are audited - 'Event ID 178'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 14'

800-53|AC-2(4)

CCI|CCI-001403

Rule-ID|SV-53788r4_rule

STIG-ID|SQL2-00-001900

Vuln-ID|V-41306

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 15'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 18'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 20'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 102'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 103'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 104'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 105'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 106'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 107'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 108'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 109'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 110'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 111'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 112'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 113'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 115'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 116'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 117'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 118'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 128'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 129'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 130'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 131'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 132'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 133'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 134'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 135'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 152'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 153'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 170'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 171'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 172'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 173'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 175'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 176'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 177'

SQL2-00-001900 - SQL Server must automatically audit account modification - 'Event ID 178'

SQL2-00-002200 - SQL Server must enforce non-DAC policies over users and resources where the policy rule set for each policy specifies access control information (i.e., position, nationality, age, project, time of day) - 'server permissions'

800-53|AC-3(3)

CCI|CCI-003014

Rule-ID|SV-53786r4_rule

STIG-ID|SQL2-00-002200

Vuln-ID|V-41304

SQL2-00-002300 - SQL Server must enforce access control policies to restrict Alter server state permissions to only authorized roles.

Rule-ID|SV-53785r3_rule

STIG-ID|SQL2-00-002300

Vuln-ID|V-41303

SQL2-00-002400 - SQL Server must enforce access control policies to restrict the Alter any event session permission to only authorized roles.

Rule-ID|SV-53784r3_rule

STIG-ID|SQL2-00-002400

Vuln-ID|V-41302

SQL2-00-002500 - SQL Server must enforce access control policies to restrict the Alter any event notification permission to only authorized roles.

Rule-ID|SV-74345r1_rule

STIG-ID|SQL2-00-002500

Vuln-ID|V-59915

SQL2-00-002600 - SQL Server must enforce access control policies to restrict the Alter any endpoint permission to only authorized roles.

Rule-ID|SV-53782r3_rule

STIG-ID|SQL2-00-002600

Vuln-ID|V-41300

SQL2-00-002700 - SQL Server must enforce access control policies to restrict the Alter any database permission to only authorized roles.

Rule-ID|SV-53781r3_rule

STIG-ID|SQL2-00-002700

Vuln-ID|V-41299

SQL2-00-002800 - SQL Server must enforce access control policies to restrict the Alter any credential permission to only authorized roles.

Rule-ID|SV-53780r3_rule

STIG-ID|SQL2-00-002800

Vuln-ID|V-41298

SQL2-00-002900 - SQL Server must enforce access control policies to restrict the Alter any connection permission to only authorized roles.

Rule-ID|SV-53779r3_rule

STIG-ID|SQL2-00-002900

Vuln-ID|V-41297

SQL2-00-003000 - SQL Server must not grant users direct access to the View any definition permission.

Rule-ID|SV-53778r5_rule

STIG-ID|SQL2-00-003000

Vuln-ID|V-41296

SQL2-00-003100 - SQL Server must not grant users direct access to the Alter any server role permission.

Rule-ID|SV-53777r4_rule

STIG-ID|SQL2-00-003100

Vuln-ID|V-41295

SQL2-00-003200 - SQL Server must not grant users direct access to the View server state permission.

Rule-ID|SV-53776r6_rule

STIG-ID|SQL2-00-003200

Vuln-ID|V-41294

SQL2-00-003300 - SQL Server must enforce access control policies to restrict the Create any database permission to only authorized roles.

Rule-ID|SV-53775r4_rule

STIG-ID|SQL2-00-003300

Vuln-ID|V-41293

SQL2-00-003400 - SQL Server must enforce access control policies to restrict the Authenticate server permission to only authorized roles.

Rule-ID|SV-53774r4_rule

STIG-ID|SQL2-00-003400

Vuln-ID|V-41292

SQL2-00-003500 - SQL Server must enforce access control policies to restrict the Alter Settings permission to only authorized roles.

Rule-ID|SV-53773r4_rule

STIG-ID|SQL2-00-003500

Vuln-ID|V-41291

SQL2-00-003600 - SQL Server must enforce access control policies to restrict the Alter any server role permission to only authorized roles.

Rule-ID|SV-53772r4_rule

STIG-ID|SQL2-00-003600

Vuln-ID|V-41290

SQL2-00-003700 - SQL Server must not grant users direct access to the Create server role permission.

Rule-ID|SV-53771r4_rule

STIG-ID|SQL2-00-003700

Vuln-ID|V-41289

SQL2-00-003800 - SQL Server must enforce access control policies to restrict the Control server permission to only authorized roles.

Rule-ID|SV-53770r4_rule

STIG-ID|SQL2-00-003800

Vuln-ID|V-41288

SQL2-00-003900 - SQL Server must not grant users direct access to the Unsafe assembly permission.

Rule-ID|SV-53769r4_rule

STIG-ID|SQL2-00-003900

Vuln-ID|V-41287

SQL2-00-004000 - SQL Server must enforce access control policies to restrict the Alter trace permission to only authorized roles.

Rule-ID|SV-53768r4_rule

STIG-ID|SQL2-00-004000

Vuln-ID|V-41286

SQL2-00-004100 - SQL Server must enforce access control policies to restrict the View server state permission to only authorized roles.

Rule-ID|SV-53767r4_rule

STIG-ID|SQL2-00-004100

Vuln-ID|V-41285

SQL2-00-004200 - SQL Server must not grant users direct access control to the Shutdown permission.

Rule-ID|SV-53766r4_rule

STIG-ID|SQL2-00-004200

Vuln-ID|V-41284

SQL2-00-004300 - SQL Server must enforce access control policies to restrict the Alter any linked server permission to only authorized roles.

Detections

Analytics

DISA STIG SQL Server 2012 DB Instance Security v1r20

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous