>> Last month, we announced
the general availability of new Azure SQL auditing capabilities.
In this episode, join me and David Trigano to learn more,
this week on Data Exposed.
[MUSIC]
>> Hi. I'm Anna Hoffman and
welcome to this episode of Data Exposed.
Today, I'm joined by David Trigano,
our Program Manager on the Azure team.
Thanks for joining us today again, David.
>> Hi, Anna. Thank you for inviting me. It's always a pleasure.
>> Always a pleasure to have you on the show.
Today, we're going to be talking about some of
the latest announcements in
auditing and then diving into some of those capabilities.
I love to just kick it off by asking you,
what are some of
these latest announcements related to auditing for Azure SQL?
>> Sure. We have three main announcements.
The first one is the new destination that
we're now supporting that is now generally available,
which is auditing to Log Analytics workspace.
The second one is auditing to Event Hub.
Two destinations that allow customers to
manage their auditing at scale in a single gotoLocation.
The second feature, or should I say, the third capability
is the auditing of Microsoft Support operation,
allowing customers to track
operations that are done by Microsoft Support Engineers.
>> Awesome. Thanks, David.
Now, we've talked a little
about or we've heard about
some of these auditing capabilities before.
For it to go generally available,
can you tell us a little bit more about what that means,
if there were any changes, or how people should think about
auditing to Event Hubs and Log
Analytics before the GA versus after the GA?
>> Sure. Before the GA,
Microsoft's recommendations for customers to try this feature,
but not to deploy this feature on production environments.
Now that those destinations are generally available,
we encourage our customers and we support customers
that deploy this destination on production environments.
>> Got you. That's helpful. It's just a fully supported way
forward and we're definitely recommending
this for production workloads now. That's really cool.
Now, this third or second option,
whichever you might want to call it,
of supporting logging of Microsoft Support operations,
can you tell us a little bit more about what that is?
>> Sure, absolutely.
When a customer today opens tickets
because there are some issues on his SQL Database,
we usually have Microsoft Support Engineers that connects
to this databases or to the underlying backends,
so to the SQL Server that runs this Azure SQL Database.
When this Microsoft Support Engineers
has to do some operation against the database, against the server,
we're basically offering to our customers
full transparency on those operations,
offering our customers a way to track
and to store those operation on their destinations.
>> Got it. That's really helpful to know.
Now, David, it would be great if you could show
us maybe how easy or how complicated it might be to set this up.
>> This is super easy and let me show you how it works.
>> Awesome.
>> I'm here on my Azure portal.
I'm on one of my SQL Server,
you can see that now I have two sections.
The first one is Azure SQL auditing and
the second one is auditing of Microsoft Support operations.
As I told you, Anna,
this is super easy.
I just have to enable Azure SQL auditing.
I'm selecting the destination that I want to send my audit logs.
Here, for example, I can select a Storage and
Log Analytics and then I will
have everything written into these destination.
I can also select to also file audit logs or should I say,
operations done by Microsoft Support Engineers
into the same destination.
Here, you can see that I can basically say,
I want to use the same destination.
All my own logs,
all my own operations that will be done on
the SQL Server and all the operations that will
be done by Microsoft Support Engineers will basically be
stored in this storage and this Log Analytics.
Now, I can also decide to send
the Microsoft Support operation in a different destination.
For example, I can say I want to use
this storage and I want to use this Log Analytics,
so I don't want to use storage but I do want to use an Event Hub.
Then very, very easily, I can
decide where I want to send my audits of
Microsoft Support operation and also
my regular audit logs in MySQL server.
>> Cool. Like he said,
this isn't just easy,
this is super easy.
That's really great to see.
Great that it's so easy to set up.
Now this is just for one, Azure SQL Instance.
Now what if I wanted to do it at scale,
is there a way that I can do that?
>> Yes, absolutely. That's a good question.
We recently released a connector
using the power of Azure Sentinel,
allowing our customers to deploy Azure SQL auditing at scale.
I'm here on the Azure Sentinel,
the Azure SIEM of Microsoft recently released.
I can go into one of my workspace, select data connectors.
Here, I will search for Azure SQL Database,
I will select "Azure SQL Databases",
click on "Open Connector Page",
and here, you can see that I have two configurations.
The first one is to enable diagnostic logs
on all your Azure SQL Database,
where I can basically run
an Azure Policy that will deploy automatically and at scale.
I can decide the scope of this deployment automatically.
For me, Microsoft will, or should I say, Azure
behind the scene will deploy and will configure
all MySQL server with the same destination.
For example, here, it's
my Log Analytics workspace that is connected to my Azure Sentinel.
This is for the diagnostic logs.
I also have the same capabilities offered to me to
connect my Azure SQL Database or at least all of
my Azure SQL Databases and servers into
a single Log Analytics workspace using the power of Azure Policy.
>> Wow, that's pretty cool. I hadn't actually seen that before.
You showed us how easily we can do it for
one Azure SQL Database or even one Azure SQL Database Server,
and then you showed us how using Azure Policy and Azure Sentinel,
we can actually do it to all of
our Azure SQL Databases or set a specific policies.
That's really cool. Now, David,
I have one last question for you.
Once we collected the logs,
like especially if we're using maybe Log Analytics,
how easy is it to look at them and start analyzing them?
>> Sure. Inside this connector part of Azure Sentinel,
we also added two query samples
that you can use to start query those logs.
Here, you have a first one.
So let me copy paste this one and post
it in my Log Analytics workspace.
Here, I will basically run this query and you will see in
live how much time it takes to run this query.
As you can see, within less than three seconds I got almost
3,000 records using the power of Azure Data Explorer.
Of course, you can also build
your own workbooks using Azure Data Explorer,
providing you advanced capabilities to monitor and to
investigate your Azure SQL audit logs at scale and as I said,
into a single gotoLocation.
>> Wow, thanks, David. This is really cool stuff.
It's almost like this is just the beginning because now that
you have these Log Analytics capabilities, Event Hub capabilities,
Microsoft Support operations capabilities,
all in general availability,
now it seems like the options are endless.
You can start querying using Azure Data Explorer in Kusto,
or you could even start creating some runbooks to run
your own custom logs or checks as these things go forward.
Now, to our viewers,
do you have any words of
advice when they start to use these services?
>> Sure. My first advice will be to start slowly
with some pre-production environment and then when you
feel comfortable, go and start to
deploy Azure SQL auditing to
your production and then when you feel really comfortable,
you use the power of Azure Sentinel to deploy at
scale within the entire SQL estate of your organization.
>> Awesome. Thanks so much, David.
It's been a really interesting episode.
I've learned a lot about Azure SQL auditing,
some of the new stuff, and especially how you can expand this to
your entire suite of Azure SQL Databases. That's really cool.
Thanks again for being on the show, David.
For our viewers, thanks for joining us.
If you like this episode, please give us a like,
comment on what you're doing with Azure SQL auditing,
and we hope to see you next time on Data Exposed.
[MUSIC]