Set-AzSqlDatabaseAudit
變更 Azure SQL 資料庫 的稽核設定。
Syntax
Set-AzSqlDatabaseAudit
[-AuditActionGroup <AuditActionGroups[]>]
[-AuditAction <String[]>]
[-PredicateExpression <String>]
[-BlobStorageTargetState <String>]
[-StorageAccountResourceId <String>]
[-StorageKeyType <String>]
[-RetentionInDays <UInt32>]
[-EventHubTargetState <String>]
[-EventHubName <String>]
[-EventHubAuthorizationRuleResourceId <String>]
[-LogAnalyticsTargetState <String>]
[-WorkspaceResourceId <String>]
[-PassThru]
[-UseIdentity <String>]
[-ResourceGroupName] <String>
[-ServerName] <String>
[-DatabaseName] <String>
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Set-AzSqlDatabaseAudit
[-AuditActionGroup <AuditActionGroups[]>]
[-AuditAction <String[]>]
[-PredicateExpression <String>]
[-BlobStorageTargetState <String>]
[-StorageAccountResourceId <String>]
[-StorageKeyType <String>]
[-RetentionInDays <UInt32>]
[-EventHubTargetState <String>]
[-EventHubName <String>]
[-EventHubAuthorizationRuleResourceId <String>]
[-LogAnalyticsTargetState <String>]
[-WorkspaceResourceId <String>]
[-PassThru]
[-UseIdentity <String>]
-DatabaseObject <AzureSqlDatabaseModel>
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Description
Set-AzSqlDatabaseAudit Cmdlet 會變更 Azure SQL 資料庫 的稽核設定。 若要使用 Cmdlet,請使用 ResourceGroupName、ServerName 和 DatabaseName 參數來識別資料庫。 當 Blob 記憶體是稽核記錄的目的地時,請指定 儲存體 AccountResourceId 參數來判斷稽核記錄的記憶體帳戶,以及用來定義記憶體密鑰的 儲存體 KeyType 參數。 您也可以設定 RetentionInDays 參數的值來定義稽核記錄的保留期,以定義稽核記錄的期間。
範例
範例 1:啟用 Azure SQL 資料庫 的 Blob 記憶體稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage"
範例 2:停用 Azure SQL 資料庫 的 Blob 記憶體稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -BlobStorageTargetState Disabled
範例 3:使用 T-SQL 述詞篩選來啟用 Azure SQL 資料庫 的 Blob 記憶體稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -PredicateExpression "schema_name <> 'sys''" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage"
範例 4:從 Azure SQL 資料庫 的稽核原則中移除篩選
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -PredicateExpression ""
範例 5:啟用 Azure SQL 資料庫 的事件中樞稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -EventHubTargetState Enabled -EventHubName "EventHubName" -EventHubAuthorizationRuleResourceId "EventHubAuthorizationRuleResourceId"
範例 6:停用 Azure SQL 資料庫 的事件中樞稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -EventHubTargetState Disabled
範例 7:啟用 Azure SQL 資料庫 的記錄分析稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2"
範例 8:停用 Azure SQL 資料庫 的記錄分析稽核原則
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -LogAnalyticsTargetState Disabled
範例 9:透過管線停用 Azure SQL 資料庫 的記錄分析稽核原則
Get-AzSqlDatabase -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" | Set-AzSqlDatabaseAudit -LogAnalyticsTargetState Disabled
範例 10:停用將 Azure SQL 資料庫 稽核記錄傳送至 Blob 記憶體,並將它們傳送至記錄分析。
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2" -BlobStorageTargetState Disabled
範例 11:啟用將 Azure SQL 資料庫 的稽核記錄傳送至 Blob 記憶體、事件中樞和記錄分析。
Set-AzSqlDatabaseAudit -ResourceGroupName "ResourceGroup01" -ServerName "Server01" -DatabaseName "Database01" -BlobStorageTargetState Enabled -StorageAccountResourceId "/subscriptions/7fe3301d-31d3-4668-af5e-211a890ba6e3/resourceGroups/resourcegroup01/providers/Microsoft.Storage/storageAccounts/mystorage" -EventHubTargetState Enabled -EventHubName "EventHubName" -EventHubAuthorizationRuleResourceId "EventHubAuthorizationRuleResourceId" -LogAnalyticsTargetState Enabled -WorkspaceResourceId "/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2"
參數
-AuditAction
稽核動作集。
要稽核的支援動作如下:
SELECT
UPDATE
INSERT
DELETE
執行 CREATE 陳述式之前,請先執行
RECEIVE
REFERENCES
定義要稽核之動作的一般窗體是:[action] ON [object] BY [principal] 注意,上述格式的 [object] 可以參照數據表、檢視或預存程式之類的物件,或是整個資料庫或架構。 針對後者,會分別使用 DATABASE::[dbname] 和 SCHEMA::[schemaname] 表單。
例如:
依公用的 dbo.myTable 上的 SELECT
SELECT on DATABASE::myDatabase by public
SELECT on SCHEMA::mySchema by public
如需詳細資訊,請參閱https://learn.microsoft.com/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions#database-level-audit-actions。
Type: | String[] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-AuditActionGroup
建議使用的一組動作群組是下列組合 - 這會稽核針對資料庫執行的所有查詢和預存程式,以及成功和失敗的登入:
“BATCH_COMPLETED_GROUP”,
“SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP”,
“FAILED_DATABASE_AUTHENTICATION_GROUP”
上述組合也是預設設定的集合。 這些群組涵蓋針對資料庫執行的所有 SQL 語句和預存程式,不應與其他群組搭配使用,因為這會導致重複的稽核記錄。
如需詳細資訊,請參閱https://learn.microsoft.com/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions#database-level-audit-action-groups。
Type: | AuditActionGroups[] |
Accepted values: | BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP, LEDGER_OPERATION_GROUP, DBCC_GROUP, DATABASE_OWNERSHIP_CHANGE_GROUP, DATABASE_CHANGE_GROUP |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-BlobStorageTargetState
指出 Blob 記憶體是否為稽核記錄的目的地。
Type: | String |
Accepted values: | Enabled, Disabled |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-Confirm
執行 Cmdlet 之前先提示您確認。
Type: | SwitchParameter |
Aliases: | cf |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-DatabaseName
SQL 資料庫 名稱。
Type: | String |
Position: | 2 |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-DatabaseObject
管理其審核策略的資料庫物件。
Type: | AzureSqlDatabaseModel |
Position: | Named |
Default value: | None |
Required: | True |
Accept pipeline input: | True |
Accept wildcard characters: | False |
-DefaultProfile
用於與 Azure 通訊的認證、帳戶、租用戶和訂用帳戶。
Type: | IAzureContextContainer |
Aliases: | AzContext, AzureRmContext, AzureCredential |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-EventHubAuthorizationRuleResourceId
事件中樞授權規則的資源標識碼
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-EventHubName
事件中樞的名稱。 如果在提供 EventHubAuthorizationRuleResourceId 時未指定任何專案,則會選取預設事件中樞。
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-EventHubTargetState
指出事件中樞是否為稽核記錄的目的地。
Type: | String |
Accepted values: | Enabled, Disabled |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-LogAnalyticsTargetState
指出記錄分析是否為稽核記錄的目的地。
Type: | String |
Accepted values: | Enabled, Disabled |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-PassThru
指定是否要在 Cmdlet 執行結束時輸出稽核原則
Type: | SwitchParameter |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-PredicateExpression
用來篩選稽核記錄的 T-SQL 述詞 (WHERE 子句)。
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ResourceGroupName
資源群組的名稱。
Type: | String |
Position: | 0 |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-RetentionInDays
稽核記錄的保留天數。
Type: | Nullable<T>[UInt32] |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-ServerName
SQL 伺服器名稱。
Type: | String |
Position: | 1 |
Default value: | None |
Required: | True |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-StorageAccountResourceId
記憶體帳戶資源標識碼
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-StorageKeyType
指定要使用哪一個記憶體存取金鑰。
Type: | String |
Accepted values: | Primary, Secondary |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-UseIdentity
指出是否要使用受控識別。 當您想要在目標記憶體不在防火牆後方時使用受控識別時,這是必要的。
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-WhatIf
顯示執行 Cmdlet 後會發生的情況。 未執行 Cmdlet。
Type: | SwitchParameter |
Aliases: | wi |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
-WorkspaceResourceId
您要傳送稽核記錄之 Log Analytics 工作區的工作區識別碼(Log Analytics 工作區的資源識別符)。 範例:/subscriptions/4b9e8510-67ab-4e9a-95a9-e2f1e570ea9c/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/viruela2
Type: | String |
Position: | Named |
Default value: | None |
Required: | False |
Accept pipeline input: | False |
Accept wildcard characters: | False |
輸入
String[]
Nullable<T>[[System.UInt32, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]
輸出
意見反應
https://aka.ms/ContentUserFeedback。
即將登場:在 2024 年,我們將逐步淘汰 GitHub 問題作為內容的意見反應機制,並將它取代為新的意見反應系統。 如需詳細資訊,請參閱:提交並檢視相關的意見反應