Azure SQL Server Deleted

AnalysisType: rule
Filename: azure_sql_server_deleted.py
RuleID: "Azure.MonitorActivity.SQL.ServerDeleted"
DisplayName: "Azure SQL Server Deleted"
Enabled: true
LogTypes:
  - Azure.MonitorActivity
Severity: Info
Description: >
  Detects when an Azure SQL Server is deleted.
  SQL Server deletion is a destructive operation that removes the entire database server instance and all databases within it.
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Impact: Data Destruction
    - TA0040:T1490 # Impact: Inhibit System Recovery
Tags:
  - Impact
  - Data Destruction
  - Inhibit System Recovery
Runbook: |
  1. Query Azure MonitorActivity logs for all SQL Server delete operations by the callerIpAddress in the 24 hours before and after this alert to identify if multiple servers are being deleted
  2. Check if the callerIpAddress is associated with known cloud providers, VPN services, or threat intelligence indicators
  3. Search for other Azure resource deletion operations from the same callerIpAddress in the past 7 days to determine the scope of data destruction activity
Reference: https://docs.datadoghq.com/security/default_rules/ab7-bv8-6bt/
SummaryAttributes:
  - resourceId
  - callerIpAddress
  - correlationId
Tests:
  - Name: SQL Server Deleted Successfully
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T10:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.SQL/servers/mysqlserver",
        "operationName": "Microsoft.SQL/servers/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "resultSignature": "200",
        "callerIpAddress": "1.1.1.1",
        "correlationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "location": "",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Case Insensitive Match
    ExpectedResult: true
    Log:
      {
        "time": "2024-12-17T11:45:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/prod-rg/providers/Microsoft.SQL/servers/prodsqlserver",
        "operationName": "microsoft.sql/servers/delete",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Succeeded",
        "callerIpAddress": "1.2.3.4",
        "correlationId": "f9e8d7c6-b5a4-3210-9876-fedcba098765",
        "location": "eastus",
        "tenantId": "87654321-4321-4321-4321-111111111111"
      }
  - Name: Different Operation
    ExpectedResult: false
    Log:
      {
        "time": "2024-12-17T13:30:00.0000000Z",
        "resourceId": "/subscriptions/12345678-1234-1234-1234-123456789abc/resourceGroups/myresourcegroup/providers/Microsoft.SQL/servers/mysqlserver",
        "operationName": "Microsoft.SQL/servers/write",
        "operationVersion": "2021-04-01",
        "category": "Administrative",
        "resultType": "Success",
        "callerIpAddress": "203.0.113.75",
        "correlationId": "d4e5f6a7-b8c9-0123-def0-234567890123",
        "location": "westus",
        "tenantId": "87654321-4321-4321-4321-210987654321"
      }

# ------ paired body: azure_sql_server_deleted.py ------

from panther_azureactivity_helpers import (
    azure_activity_alert_context,
    azure_activity_success,
    extract_resource_name_from_id,
)

SQL_SERVER_DELETE = "MICROSOFT.SQL/SERVERS/DELETE"


def rule(event):
    return event.get("operationName", "").upper() == SQL_SERVER_DELETE and azure_activity_success(
        event
    )


def title(event):
    resource_id = event.get("resourceId", "")
    sql_server = extract_resource_name_from_id(
        resource_id, "servers", default="<UNKNOWN_SQL_SERVER>"
    )

    return f"Azure SQL Server deleted [{sql_server}]"


def alert_context(event):
    context = azure_activity_alert_context(event)

    resource_id = event.get("resourceId", "")
    resource_group = extract_resource_name_from_id(resource_id, "resourceGroups", default="")
    if resource_group:
        context["resource_group"] = resource_group

    return context