7f640e74e5
Some checks are pending
CI / Build og unit tests (push) Waiting to run
CI / Integration (mcr.microsoft.com/mssql/server:2017-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2019-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2022-latest) (push) Blocked by required conditions
CI / Integration (mcr.microsoft.com/mssql/server:2025-latest) (push) Blocked by required conditions
Rules can now be data: a JSON file with one read-only SELECT where every
row is a finding, with {column} templates, server or per-database scope,
minimum version, sensitive columns and references. Community rules live
in rules/community (reviewed via pull request), ship with every build
and with the signed rule pack; local rules are read from the agent's
data folder every five minutes. Queries are checked for anything that
could write, run with the least-privilege login, and a missing
permission makes the rule not measurable rather than failing. The
rule engine picks up catalog changes without a restart. Authors get
'rules validate' and 'rules test --instance'. Four example community
rules (sa active, orphaned database owners, default trace off,
untrusted foreign keys).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
40 lines
2.6 KiB
JSON
40 lines
2.6 KiB
JSON
[
|
|
{
|
|
// Contributed as an example of a server-scoped community rule.
|
|
"id": "COM-SEC-001",
|
|
"title": "Login'et sa er aktivt",
|
|
"severity": "Medium",
|
|
"query": "SELECT name AS [login], CASE WHEN is_policy_checked = 1 THEN 'ja' ELSE 'nej' END AS [password_policy] FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled = 0",
|
|
"subject": "login: sa",
|
|
"findingTitle": "Det indbyggede login '{login}' er aktivt",
|
|
"explanation": "sa er det login, angribere prøver først, fordi navnet er kendt, og det har fulde rettigheder. Password-politik håndhæves: {password_policy}.",
|
|
"recommendation": "Deaktivér sa (ALTER LOGIN [sa] DISABLE) og brug navngivne logins, helst Windows-logins. Er sa i brug af en applikation, så giv applikationen sit eget login med de rettigheder, den behøver.",
|
|
"references": [
|
|
{ "title": "Choose an authentication mode (sa)", "url": "https://learn.microsoft.com/sql/relational-databases/security/choose-an-authentication-mode" }
|
|
],
|
|
"author": "SQLInsight Pro"
|
|
},
|
|
{
|
|
"id": "COM-SEC-002",
|
|
"minimumVersion": "10.0",
|
|
"title": "Database ejes af et login, der ikke findes",
|
|
"severity": "Low",
|
|
"query": "SELECT d.name AS [database], CONVERT(varchar(100), d.owner_sid, 1) AS [owner_sid] FROM sys.databases d LEFT JOIN sys.server_principals p ON p.sid = d.owner_sid WHERE p.sid IS NULL AND d.database_id > 4",
|
|
"subject": "database: {database}",
|
|
"findingTitle": "Databasen {database} ejes af et login, der ikke længere findes",
|
|
"explanation": "Ejeren er typisk en medarbejder, som er stoppet, eller en database, der er gendannet fra en anden server. Det giver fejl i fx EXECUTE AS OWNER, cross-database ownership chaining og nogle jobs.",
|
|
"recommendation": "Sæt en ejer, der findes, fx et dedikeret, deaktiveret login: ALTER AUTHORIZATION ON DATABASE::[{database}] TO [sa-ejer]; Undgå at bruge personlige logins som ejer.",
|
|
"author": "SQLInsight Pro"
|
|
},
|
|
{
|
|
"id": "COM-CFG-001",
|
|
"title": "Default trace er slået fra",
|
|
"severity": "Low",
|
|
"query": "SELECT CAST(value_in_use AS int) AS [value_in_use] FROM sys.configurations WHERE name = 'default trace enabled' AND value_in_use = 0",
|
|
"subject": "configuration: default trace enabled",
|
|
"findingTitle": "Default trace er slået fra",
|
|
"explanation": "Default trace er en let sporing, der registrerer bl.a. autogrowth, ændringer af objekter og logins. Uden den er det svært at efterforske, hvad der skete, efter en hændelse.",
|
|
"recommendation": "Slå den til igen: EXEC sp_configure 'default trace enabled', 1; RECONFIGURE; Den koster næsten intet.",
|
|
"author": "SQLInsight Pro"
|
|
}
|
|
]
|