Back to Checks
azure

Defender for Open-Source Relational Databases is set to On (Standard pricing tier)

defender_ensure_defender_for_os_relational_databases_is_on
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/pricings

Microsoft Defender for Cloud plan for Open-Source Relational Databases is evaluated for the Standard pricing tier at the subscription level.

Prowler logoProwlerprowler-provider-azure

Risk

Absent the Standard plan, open-source databases lack threat detection and behavior analytics, reducing confidentiality and integrity. SQL injection, brute-force logins, and data exfiltration may go unnoticed, delaying response and enabling lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_defender_for_os_relational_databases_is_on

Recommendation

Enable the plan at the Standard tier across relevant subscriptions. Apply defense in depth: enforce least privilege, isolate databases on private networks, require strong authentication, and route alerts to centralized monitoring for rapid triage. Review coverage regularly.

Remediation

CLI

az security pricing create --name OpenSourceRelationalDatabases --tier Standard

Terraform

resource "azurerm_security_center_subscription_pricing" "example_resource_name" {
  resource_type = "OpenSourceRelationalDatabases"
  tier          = "Standard" # Critical: enables Defender (Standard tier)
}

NativeIaC

// Deploy at subscription scope to set Defender pricing
targetScope = 'subscription'

resource pricingOpenSource "Microsoft.Security/pricings@2023-01-01" = {
  name: 'OpenSourceRelationalDatabases'
  properties: {
    pricingTier: 'Standard' // Critical: sets the plan to Standard (ON)
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Select Environment settings > your subscription
3Open Defender plans
4Find "Open-source relational databases" and set it to Standard/On
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_defender_for_os_relational_databases_is_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "OpenSourceRelationalDatabases" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=pricings["OpenSourceRelationalDatabases"],
                )
                report.subscription = subscription
                report.resource_name = "Defender plan Open-Source Relational Databases"
                report.status = "PASS"
                report.status_extended = f"Defender plan Defender for Open-Source Relational Databases from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
                if pricings["OpenSourceRelationalDatabases"].pricing_tier != "Standard":
                    report.status = "FAIL"
                    report.status_extended = f"Defender plan Defender for Open-Source Relational Databases from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."

                findings.append(report)
        return findings

References