Detections
Analytics
SQL4-00-012100 - SQL Server must produce Trace or Audit records containing sufficient information to establish the sources (origins) of the events - origins of the events.
Information
Information system auditing capability is critical for accurate forensic analysis. Audit record content which may be necessary to satisfy the requirement of this control includes, but is not limited to: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.SQL Server is capable of a range of actions on data stored within the database. It is important, for accurate forensic analysis, to know exactly who performed what actions. This requires specific information regarding the source of the event an audit record is referring to. If the source of the event information is not recorded and stored with the audit record, the record itself is of very limited use.
The source of the event can be a user account and sometimes a system account when timed jobs are run. Without information establishing the source of activity, the value of audit records from a forensics perspective is questionable. If Trace is enabled for auditing, SQL Server does capture the source of the event-specific information in all audit records.
Use of SQL Server Audit is recommended. All features of SQL Server Audit are available in the Enterprise and Developer editions of SQL Server 2014. It is not available at the database level in other editions. For this or legacy reasons, the instance may be using SQL Server Trace for auditing, which remains an acceptable solution for the time being. Note, however, that Microsoft intends to remove most aspects of Trace at some point after SQL Server 2016.
Solution
Design and deploy a SQL Server Audit or Trace that captures the NT User Name, NT Domain Name, Host Name, Client Process ID, Application Name, Login Name, SPID, DB User Name, and Login SID (each where relevant) for all auditable events.The script provided in the supplemental file Trace.sql can be used to create a trace.
If SQL Server Audit is intended to be in use, design and deploy an Audit that captures all auditable events. The code provided in the supplemental file Audit.sql can be used as the basis for creating an Audit.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2014_Y24M07_STIG.zip
Item Details
Audit Name: DISA STIG SQL Server 2014 Instance DB Audit v2r4
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-3, CAT|II, CCI|CCI-000133, Rule-ID|SV-213815r960900_rule, STIG-ID|SQL4-00-012100, STIG-Legacy|SV-82267, STIG-Legacy|V-67777, Vuln-ID|V-213815
Plugin: MS_SQLDB
Control ID: 9b84a76bc13cea0f8f66947e2e7f55d98749525b304521fbb9d88763c3755b4f