prowler 5.17.0__py3-none-any.whl → 5.18.0__py3-none-any.whl

prowler/providers/azure/services/postgresql/postgresql_flexible_server_allow_access_services_disabled/postgresql_flexible_server_allow_access_services_disabled.metadata.json

@@ -1,30 +1,37 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_allow_access_services_disabled",
-  "CheckTitle": "Ensure 'Allow access to Azure services' for PostgreSQL Database Server is disabled",
+  "CheckTitle": "PostgreSQL flexible server has 'Allow public access from any Azure service' disabled",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "Severity": "high",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Disable access from Azure services to PostgreSQL Database Server.",
-  "Risk": "If access from Azure services is enabled, the server's firewall will accept connections from all Azure resources, including resources not in your subscription. This is usually not a desired configuration. Instead, set up firewall rules to allow access from specific network ranges or VNET rules to allow access from specific virtual networks.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules",
+  "Description": "**Azure Database for PostgreSQL Flexible Server** firewall should not include the rule that allows connections from **any Azure service**, represented by `start_ip=0.0.0.0` and `end_ip=0.0.0.0`.",
+  "Risk": "Allowing **all Azure services** erodes network isolation, permitting unsolicited connections from other subscriptions and tenants. This enables credential brute force and unauthorized access paths, risking data **confidentiality** and **integrity**, and increasing the chance of service disruption (**availability**).",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/cli/azure/postgres/flexible-server/firewall-rule?view=azure-cli-latest",
+    "https://learn.microsoft.com/en-us/azure/postgresql/network/how-to-networking-servers-deployed-public-access-disable-public-access?tabs=portal-disable-public-access",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/disable-all-services-access.html#"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server firewall-rule delete --name AllowAllWindowsAzureIps --resource-group <resourceGroupName> --server-name <serverName>",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/disable-all-services-access.html#",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/ensure-allow-access-to-azure-services-for-postgresql-database-server-is-disabled#terraform"
+      "CLI": "az postgres flexible-server firewall-rule delete --resource-group <resourceGroupName> --name <serverName> --rule-name <rule_name>",
+      "NativeIaC": "```bicep\n// Update the existing firewall rule that allowed Azure services (0.0.0.0) to a specific IP/range\nresource fwRule 'Microsoft.DBforPostgreSQL/flexibleServers/firewallRules@2023-03-01-preview' = {\n  name: '<example_server_name>/<example_rule_name>'\n  properties: {\n    startIpAddress: '<START_IP>' // critical: not 0.0.0.0; disables \"Allow Azure services\"\n    endIpAddress: '<END_IP>'     // critical: not 0.0.0.0\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Azure Database for PostgreSQL flexible server and select your server\n2. Open Networking > Firewall rules\n3. Find the rule where Start IP and End IP are both 0.0.0.0\n4. Select it and click Delete\n5. Click Save",
+      "Terraform": "```hcl\n# Update the existing rule to not use 0.0.0.0 (disables \"Allow Azure services\")\nresource \"azurerm_postgresql_flexible_server_firewall_rule\" \"<example_resource_name>\" {\n  name             = \"<example_rule_name>\"\n  server_id        = \"<example_resource_id>\"\n  start_ip_address = \"<START_IP>\" # critical: not 0.0.0.0\n  end_ip_address   = \"<END_IP>\"   # critical: not 0.0.0.0\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. Login to Azure Portal using https://portal.azure.com. 2. Go to Azure Database for PostgreSQL servers. 3. For each database, click on Connection security. 4. Under Firewall rules, set Allow access to Azure services to No. 5. Click Save. From Azure CLI Use the below command to delete the AllowAllWindowsAzureIps rule for PostgreSQL Database. az postgres server firewall-rule delete --name AllowAllWindowsAzureIps -- resource-group <resourceGroupName> --server-name <serverName>",
-      "Url": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/quickstart-create-server-database-azure-cli#configure-a-server-based-firewall-rule"
+      "Text": "Remove the `0.0.0.0` rule and apply **least privilege**:\n- Use **Private Endpoints** for access\n- Allow only required source IP ranges\n- Isolate with VNET rules and NSGs\n- Enforce TLS and strong authentication\n- Monitor connection logs for anomalies",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_allow_access_services_disabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "trust-boundaries"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/postgresql/postgresql_flexible_server_connection_throttling_on/postgresql_flexible_server_connection_throttling_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_connection_throttling_on",
-  "CheckTitle": "Ensure server parameter 'connection_throttling' is set to 'ON' for PostgreSQL Database Server",
+  "CheckTitle": "Flexible PostgreSQL server has connection_throttling enabled",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable connection_throttling on PostgreSQL Servers.",
-  "Risk": "Enabling connection_throttling helps the PostgreSQL Database to Set the verbosity of logged messages. This in turn generates query and error logs with respect to concurrent connections that could lead to a successful Denial of Service (DoS) attack by exhausting connection resources. A system can also fail or be degraded by an overload of legitimate users. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.",
-  "RelatedUrl": " https://docs.microsoft.com/en-us/rest/api/postgresql/configurations/listbyserver",
+  "Description": "**Azure PostgreSQL flexible servers** where the `connection_throttling` parameter is set to `ON`",
+  "Risk": "Without `connection_throttling`, bursts of new sessions can exhaust connection slots and CPU, degrading **availability** and causing timeouts.\n\nReduced telemetry delays detection of **DoS** or runaway clients, extending impact and recovery time.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/connection-throttling.html",
+    "https://support.icompaas.com/support/solutions/articles/62000229889-ensure-server-parameter-connection-throttling-is-set-to-on-for-postgresql-database-server"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name connection_throttling --value on",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/connection-throttling.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/bc_azr_networking_13#terraform"
+      "CLI": "az postgres flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name connection_throttle.enable --value on",
+      "NativeIaC": "```bicep\n// Configure an existing Flexible Server parameter\nresource exampleServer 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {\n  name: '<example_resource_name>'\n}\n\nresource connectionThrottling 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {\n  name: 'connection_throttle.enable'\n  parent: exampleServer\n  properties: {\n    value: 'on' // CRITICAL: Enables connection_throttle.enable to pass the check\n  }\n}\n```",
+      "Other": "1. Sign in to Azure Portal and go to Azure Database for PostgreSQL flexible servers\n2. Select the target server\n3. In Settings, click Server parameters\n4. Search for connection_throttle.enable\n5. Set the value to ON and click Save",
+      "Terraform": "```hcl\nresource \"azurerm_postgresql_flexible_server_configuration\" \"<example_resource_name>\" {\n  name      = \"connection_throttle.enable\"\n  server_id = \"<example_resource_id>\"\n  value     = \"on\" # CRITICAL: Enables connection_throttle.enable to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. Login to Azure Portal using https://portal.azure.com. 2. Go to Azure Database for PostgreSQL servers. 3. For each database, click on Server parameters. 4. Search for connection_throttling. 5. Click ON and save. From Azure CLI Use the below command to update connection_throttling configuration. az postgres server configuration set --resource-group <resourceGroupName> -- server-name <serverName> --name connection_throttling --value on From PowerShell Use the below command to update connection_throttling configuration. Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> - ServerName <ServerName> -Name connection_throttling -Value on",
-      "Url": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/how-to-configure-server-parameters-using-portal"
+      "Text": "Enable `connection_throttling` and align connection limits with expected load.\n\nApply **defense in depth**: use connection pooling, exponential backoff, and alerts on connection spikes; prefer private access and restrictive networking to reduce exposure.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_connection_throttling_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/postgresql/postgresql_flexible_server_enforce_ssl_enabled/postgresql_flexible_server_enforce_ssl_enabled.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_enforce_ssl_enabled",
-  "CheckTitle": "Ensure 'Enforce SSL connection' is set to 'ENABLED' for PostgreSQL Database Server",
+  "CheckTitle": "PostgreSQL Flexible Server enforces SSL connections",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "Severity": "high",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable SSL connection on PostgreSQL Servers.",
-  "Risk": "SSL connectivity helps to provide a new layer of security by connecting database server to client applications using Secure Sockets Layer (SSL). Enforcing SSL connections between database server and client applications helps protect against 'man in the middle' attacks by encrypting the data stream between the server and application.",
-  "RelatedUrl": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/concepts-ssl-connection-security",
+  "Description": "**Azure Database for PostgreSQL flexible servers** are evaluated for **encrypted in-transit connections**, specifically whether `require_secure_transport` is set to `ON` to force TLS for all client sessions.",
+  "Risk": "Without enforced **TLS**, clients may connect in plaintext or with weak settings, exposing credentials and data to **man-in-the-middle**, query tampering, and session hijacking. This undermines **confidentiality** and **integrity**, and can enable lateral movement if stolen creds are reused.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-security?source=recommendations",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/require-secure-transport-for-postgres-flexible-servers.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled",
-      "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/azure/azure-networking-policies/bc_azr_networking_10",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/bc_azr_networking_10#terraform"
+      "CLI": "az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name require_secure_transport --value ON",
+      "NativeIaC": "```bicep\n// Enable SSL/TLS enforcement on an existing PostgreSQL Flexible Server\nresource server 'Microsoft.DBforPostgreSQL/flexibleServers@2023-12-01' existing = {\n  name: '<example_resource_name>'\n}\n\nresource requireSecureTransport 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-12-01' = {\n  name: '${server.name}/require_secure_transport'\n  properties: {\n    value: 'ON' // CRITICAL: Enforces SSL/TLS by turning require_secure_transport ON\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal\n2. Go to: Azure Database for PostgreSQL flexible server > your server\n3. Select Server parameters\n4. Search for require_secure_transport\n5. Set it to ON\n6. Click Save",
+      "Terraform": "```hcl\n# Enable SSL/TLS enforcement on a PostgreSQL Flexible Server\nresource \"azurerm_postgresql_flexible_server_configuration\" \"<example_resource_name>\" {\n  name      = \"require_secure_transport\"   # CRITICAL: Target the SSL enforcement parameter\n  server_id = \"<example_resource_id>\"      # ID of the target flexible server\n  value     = \"ON\"                          # CRITICAL: Enforce SSL/TLS\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. Login to Azure Portal using https://portal.azure.com 2. Go to Azure Database for PostgreSQL server 3. For each database, click on Connection security 4. In SSL settings, click on ENABLED to enforce SSL connections 5. Click Save From Azure CLI Use the below command to enforce ssl connection for PostgreSQL Database. az postgres server update --resource-group <resourceGroupName> --name <serverName> --ssl-enforcement Enabled From PowerShell Update-AzPostgreSqlServer -ResourceGroupName <ResourceGroupName > -ServerName <ServerName> -SslEnforcement Enabled",
-      "Url": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/concepts-ssl-connection-security"
+      "Text": "Enforce encryption in transit: set `require_secure_transport=ON`, prefer **TLS 1.3** (or at least `ssl_min_protocol_version=1.2`), and require clients to verify server identity. Disable mixed modes, rotate certificates, and restrict access via **private endpoints** to apply **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_enforce_ssl_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "encryption"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "."

prowler/providers/azure/services/postgresql/postgresql_flexible_server_entra_id_authentication_enabled/postgresql_flexible_server_entra_id_authentication_enabled.metadata.json

@@ -1,13 +1,13 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_entra_id_authentication_enabled",
-  "CheckTitle": "PostgreSQL Flexible Server enforces Microsoft Entra ID authentication with administrators",
+  "CheckTitle": "Microsoft Entra ID authentication is enabled for PostgreSQL Flexible Server",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
   "Description": "**PostgreSQL Flexible Servers** must set `authConfig.activeDirectoryAuth` to `Enabled` and keep at least one **Microsoft Entra administrator** assigned so database sessions inherit centrally governed identities instead of unmanaged PostgreSQL accounts.",
   "Risk": "Without Entra ID authentication, stolen local passwords bypass **MFA** and conditional access, enabling persistent database logins. Missing administrators leaves the feature unusable, blocking security teams from rotating duties and allowing unauthorized access or **privilege escalation**.",
@@ -18,8 +18,8 @@
   ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres flexible-server update --resource-group <resourceGroupName> --name <serverName> --active-directory-auth Enabled\naz postgres flexible-server microsoft-entra-admin create --resource-group <resourceGroupName> --server-name <serverName> --object-id <objectId> --display-name <displayName>",
-      "NativeIaC": "",
+      "CLI": "az postgres flexible-server update --resource-group <resourceGroupName> --name <serverName> --active-directory-auth Enabled\naz postgres flexible-server ad-admin create --resource-group <resourceGroupName> --server-name <serverName> --object-id <objectId> --display-name <displayName> --type User",
+      "NativeIaC": "```bicep\n// Enable Microsoft Entra ID authentication on an existing PostgreSQL Flexible Server\nresource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {\n  name: '<example_resource_name>'\n}\n\n// Update server to enable Entra ID authentication\nresource serverUpdate 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' = {\n  name: server.name\n  location: server.location\n  properties: {\n    authConfig: {\n      activeDirectoryAuth: 'Enabled' // CRITICAL: Enables Entra ID authentication\n      tenantId: tenant().tenantId\n    }\n  }\n}\n\n// Add Entra ID administrator\nresource entraAdmin 'Microsoft.DBforPostgreSQL/flexibleServers/administrators@2023-12-01-preview' = {\n  parent: server\n  name: '<objectId>' // CRITICAL: Object ID of the Entra ID principal\n  properties: {\n    principalName: '<displayName>' // User principal name or group display name\n    principalType: 'User' // CRITICAL: Can be 'User', 'Group', or 'ServicePrincipal'\n    tenantId: tenant().tenantId\n  }\n  dependsOn: [\n    serverUpdate\n  ]\n}\n```",
       "Other": "1. In the Azure Portal, open Azure Database for PostgreSQL flexible server and select the target server.\n2. Under Security > Authentication, set Microsoft Entra ID authentication (or combined mode) to Enabled and save the change.\n3. Under Security > Microsoft Entra ID, add at least one administrator (user or group) linked to an Entra object ID and confirm the assignment.",
       "Terraform": "```hcl\ndata \"azurerm_client_config\" \"current\" {}\n\nresource \"azurerm_postgresql_flexible_server\" \"example\" {\n  name                = \"pg-flex\"\n  resource_group_name = azurerm_resource_group.example.name\n  location            = azurerm_resource_group.example.location\n  sku_name            = \"GP_Standard_D4s_v3\"\n  administrator_login = \"pgadmin\"\n  administrator_password = \"<complexPassword>\"\n  storage_mb          = 131072\n  version             = \"16\"\n\n  authentication {\n    active_directory_auth_enabled = true\n    tenant_id                     = data.azurerm_client_config.current.tenant_id\n  }\n}\n\nresource \"azurerm_postgresql_flexible_server_active_directory_administrator\" \"entra_admin\" {\n  server_id     = azurerm_postgresql_flexible_server.example.id\n  object_id     = var.entra_object_id\n  principal_name = var.entra_principal_name\n  principal_type = \"User\"\n  tenant_id     = data.azurerm_client_config.current.tenant_id\n}\n```"
     },

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_checkpoints_on/postgresql_flexible_server_log_checkpoints_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_log_checkpoints_on",
-  "CheckTitle": "Ensure Server Parameter 'log_checkpoints' is set to 'ON' for PostgreSQL Database Server",
+  "CheckTitle": "PostgreSQL Flexible Server has checkpoint logging enabled",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "Severity": "low",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable log_checkpoints on PostgreSQL Servers.",
-  "Risk": "Enabling log_checkpoints helps the PostgreSQL Database to Log each checkpoint in turn generates query and error logs. However, access to transaction logs is not supported. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.",
-  "RelatedUrl": " https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server",
+  "Description": "**Azure PostgreSQL Flexible Server** has **checkpoint logging** enabled when `log_checkpoints=on`, recording each checkpoint in the server logs",
+  "Risk": "Without **checkpoint logging**, visibility into write and recovery activity is reduced, hindering incident investigation and tamper detection. Unseen checkpoint storms or WAL pressure can degrade I/O and recovery, threatening **availability** and data **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://support.icompaas.com/support/solutions/articles/62000234792-enable-log-checkpoints-parameter-on-azure-postgresql-servers-for-improved-monitoring-and-troubleshoot",
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-checkpoints.html#"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_checkpoints --value on",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-checkpoints.html#",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/bc_azr_networking_11#terraform"
+      "CLI": "az postgres flexible-server parameter set --resource-group <resourceGroupName> --server-name <serverName> --name log_checkpoints --value ON",
+      "NativeIaC": "```bicep\n// Set log_checkpoints to ON on an existing Flexible Server\nresource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {\n  name: '<example_resource_name>'\n}\n\nresource cfg 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {\n  name: 'log_checkpoints'\n  parent: server\n  properties: {\n    value: 'ON' // CRITICAL: enables checkpoint logging to pass the check\n  }\n}\n```",
+      "Other": "1. In the Azure portal, open your Azure Database for PostgreSQL flexible server\n2. Go to Settings > Server parameters\n3. Search for \"log_checkpoints\"\n4. Set the value to ON\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_postgresql_flexible_server_configuration\" \"<example_resource_name>\" {\n  name      = \"log_checkpoints\"\n  server_id = \"<example_resource_id>\"\n  \n  value = \"ON\" # CRITICAL: enables checkpoint logging to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. From Azure Home select the Portal Menu. 2. Go to Azure Database for PostgreSQL servers. 3. For each database, click on Server parameters. 4. Search for log_checkpoints. 5. Click ON and save. From Azure CLI Use the below command to update log_checkpoints configuration. az postgres server configuration set --resource-group <resourceGroupName> -- server-name <serverName> --name log_checkpoints --value on From PowerShell Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> - ServerName <ServerName> -Name log_checkpoints -Value on",
-      "Url": "https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal"
+      "Text": "Enable `log_checkpoints=on` and send logs to centralized, tamper-resistant storage. Monitor checkpoint frequency and failures with alerts. Apply **least privilege** to log access and set retention to support forensics as part of a **defense-in-depth** logging strategy.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_log_checkpoints_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_connections_on/postgresql_flexible_server_log_connections_on.metadata.json

@@ -1,30 +1,37 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_log_connections_on",
-  "CheckTitle": "Ensure server parameter 'log_connections' is set to 'ON' for PostgreSQL Database Server",
+  "CheckTitle": "PostgreSQL flexible server has log_connections enabled",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable log_connections on PostgreSQL Servers.",
-  "Risk": "Enabling log_connections helps PostgreSQL Database to log attempted connection to the server, as well as successful completion of client authentication. Log data can be used to identify, troubleshoot, and repair configuration errors and suboptimal performance.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/rest/api/postgresql/configurations/listbyserver",
+  "Description": "**Azure Database for PostgreSQL Flexible Server** evaluates the `log_connections` setting that controls logging of client connection attempts and authentication results.\n\nThe finding indicates whether this parameter is set to `ON`.",
+  "Risk": "Without **connection logging**, visibility of access attempts is lost, making **brute force** and **credential stuffing** harder to detect. This weakens **confidentiality** and **integrity**, hinders incident investigations, and can mask **lateral movement** or unauthorized data access.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/answers/questions/683954/log-connections-cannot-be-set-on-azure-postgresql",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/log-connections.html",
+    "https://learn.microsoft.com/en-us/azure/postgresql/security/security-audit?tabs=portal"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_connections --value on",
+      "CLI": "",
       "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-connections.html",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/bc_azr_networking_12#terraform"
+      "Other": "1. Sign in to the Azure portal\n2. Go to: Azure Database for PostgreSQL > Flexible servers > select <example_resource_name>\n3. Under Settings, open Server parameters and search for \"log_connections\"\n4. Confirm the parameter shows Value: ON and is Read-only (no change required)",
+      "Terraform": ""
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. Login to Azure Portal using https://portal.azure.com. 2. Go to Azure Database for PostgreSQL servers. 3. For each database, click on Server parameters. 4. Search for log_connections. 5. Click ON and save. From Azure CLI Use the below command to update log_connections configuration. az postgres server configuration set --resource-group <resourceGroupName> -- server-name <serverName> --name log_connections --value on From PowerShell Use the below command to update log_connections configuration. Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> - ServerName <ServerName> -Name log_connections -Value on",
-      "Url": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/how-to-configure-server-parameters-using-portal"
+      "Text": "Set `log_connections` to `ON` and integrate logs with centralized monitoring. Define retention and alerts for abnormal patterns. Combine with **least privilege**, strong authentication, and network restrictions to deliver **defense in depth** and prevent unauthorized access.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_log_connections_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_disconnections_on/postgresql_flexible_server_log_disconnections_on.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_log_disconnections_on",
-  "CheckTitle": "Ensure server parameter 'log_disconnections' is set to 'ON' for PostgreSQL Database Server",
+  "CheckTitle": "PostgreSQL Flexible Server has disconnection logging enabled",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Enable log_disconnections on PostgreSQL Servers.",
-  "Risk": "Enabling log_disconnections helps PostgreSQL Database to Logs end of a session, including duration, which in turn generates query and error logs. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server",
+  "Description": "**Azure Database for PostgreSQL Flexible Server** uses the `log_disconnections` setting to record when client sessions end and how long they lasted.",
+  "Risk": "Without **disconnection logs**, session timelines and user activity are opaque, weakening **auditability** and **forensics**.\n\nAbuse such as stolen credentials, short-lived access, or hijacked sessions can go unnoticed, enabling data exfiltration and privilege misuse, impacting **confidentiality** and **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/postgresql/security/security-audit?tabs=portal",
+    "https://learn.microsoft.com/en-us/azure/postgresql/single-server/how-to-configure-server-parameters-using-portal"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_disconnections --value on",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/PostgreSQL/log-disconnections.html",
-      "Terraform": ""
+      "CLI": "az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name log_disconnections --value on",
+      "NativeIaC": "```bicep\n// Enable log_disconnections on an existing PostgreSQL Flexible Server\nresource server 'Microsoft.DBforPostgreSQL/flexibleServers@2022-12-01' existing = {\n  name: '<example_resource_name>'\n}\n\nresource logDisconnections 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2022-12-01' = {\n  name: 'log_disconnections'\n  parent: server\n  properties: {\n    value: 'on' // Critical: turns log_disconnections ON to pass the check\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Azure Database for PostgreSQL flexible servers\n2. Select your server\n3. Under Settings, open Server parameters\n4. Search for log_disconnections\n5. Set it to ON\n6. Click Save",
+      "Terraform": "```hcl\n# Enable log_disconnections on a PostgreSQL Flexible Server\nresource \"azurerm_postgresql_flexible_server_configuration\" \"log_disconnections\" {\n  server_id = \"<example_resource_id>\"\n  name      = \"log_disconnections\"\n  value     = \"on\" # Critical: turns log_disconnections ON to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. From Azure Home select the Portal Menu 2. Go to Azure Database for PostgreSQL servers 3. For each database, click on Server parameters 4. Search for log_disconnections. 5. Click ON and save. From Azure CLI Use the below command to update log_disconnections configuration. az postgres server configuration set --resource-group <resourceGroupName> -- server-name <serverName> --name log_disconnections --value on From PowerShell Use the below command to update log_disconnections configuration. Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGr",
-      "Url": "https://learn.microsoft.com/en-us/azure/postgresql/single-server/how-to-configure-server-parameters-using-portal"
+      "Text": "Enable `log_disconnections` on all Flexible Servers. Complement with `log_connections` and appropriate duration/statement logging, centralize and retain logs, and alert on abnormal connect/disconnect patterns. Restrict log access. This enforces **accountability**, supports **defense in depth**, and speeds incident response.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_log_disconnections_on"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "Enabling this setting will enable a log of all disconnections. If this is enabled for a high traffic server, the log may grow exponentially."

prowler/providers/azure/services/postgresql/postgresql_flexible_server_log_retention_days_greater_3/postgresql_flexible_server_log_retention_days_greater_3.metadata.json

@@ -1,30 +1,36 @@
 {
   "Provider": "azure",
   "CheckID": "postgresql_flexible_server_log_retention_days_greater_3",
-  "CheckTitle": "Ensure Server Parameter 'log_retention_days' is greater than 3 days for PostgreSQL Database Server",
+  "CheckTitle": "PostgreSQL flexible server log_retention_days is between 4 and 7 days",
   "CheckType": [],
   "ServiceName": "postgresql",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "PostgreSQL",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
   "ResourceGroup": "database",
-  "Description": "Ensure log_retention_days on PostgreSQL Servers is set to an appropriate value.",
-  "Risk": "Configuring log_retention_days determines the duration in days that Azure Database for PostgreSQL retains log files. Query and error logs can be used to identify, troubleshoot, and repair configuration errors and sub-optimal performance.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/postgresql/howto-configure-server-parameters-using-portal",
+  "Description": "Log retention on **Azure Database for PostgreSQL Flexible Server** is governed by `log_retention_days`. Configuration is assessed as set and within `4-7` days versus unset or outside this range.",
+  "Risk": "**Insufficient or disabled log retention** limits the audit trail needed to detect brute-force, SQL injection, or insider misuse, impeding investigation. **Excessive retention** enlarges exposure if logs are accessed, risking sensitive query data leakage and policy violations. This reduces visibility and weakens confidentiality and integrity.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/postgresql/monitor/concepts-logging",
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-retention-days.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "az postgres server configuration set --resource-group <resourceGroupName> --server-name <serverName> --name log_retention_days --value <4-7>",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/PostgreSQL/log-retention-days.html",
-      "Terraform": ""
+      "CLI": "az postgres flexible-server parameter set --resource-group <RESOURCE_GROUP> --server-name <SERVER_NAME> --name logfiles.retention_days --value 7",
+      "NativeIaC": "```bicep\n// Set log retention to a compliant value (4-7 days) for an existing Flexible Server\nresource cfg 'Microsoft.DBforPostgreSQL/flexibleServers/configurations@2023-03-01-preview' = {\n  name: '<example_resource_name>/logfiles.retention_days'\n  properties: {\n    value: '7' // Critical: sets logfiles.retention_days within 4-7 to pass the check\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to Azure Database for PostgreSQL > Flexible servers and open your server\n2. Select Server parameters\n3. Search for logfiles.retention_days\n4. Set the value to a number between 4 and 7 (e.g., 7)\n5. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_postgresql_flexible_server_configuration\" \"<example_resource_name>\" {\n  server_id = \"<example_resource_id>\"\n  name      = \"logfiles.retention_days\"\n  value     = \"7\" # Critical: sets retention within 4-7 to pass the check\n}\n```"
     },
     "Recommendation": {
-      "Text": "From Azure Portal 1. From Azure Home select the Portal Menu. 2. Go to Azure Database for PostgreSQL servers. 3. For each database, click on Server parameters. 4. Search for log_retention_days. 5. Input a value between 4 and 7 (inclusive) and click Save. From Azure CLI Use the below command to update log_retention_days configuration. az postgres server configuration set --resource-group <resourceGroupName> -- server-name <serverName> --name log_retention_days --value <4-7> From Powershell Use the below command to update log_retention_days configuration. Update-AzPostgreSqlConfiguration -ResourceGroupName <ResourceGroupName> - ServerName <ServerName> -Name log_retention_days -Value <4-7>",
-      "Url": "https://learn.microsoft.com/en-us/rest/api/postgresql/singleserver/configurations/list-by-server?view=rest-postgresql-singleserver-2017-12-01&tabs=HTTP"
+      "Text": "Set `log_retention_days` to `4-7` to balance visibility and exposure. Export logs to centralized SIEM or secure storage for longer retention and analysis. Enforce **least privilege**, encryption, and immutability on log data, and monitor for gaps. Apply **defense in depth** with alerts on anomalous queries and failed logins.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_log_retention_days_greater_3"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": "Configuring this setting will result in logs being retained for the specified number of days. If this is configured on a high traffic server, the log may grow quickly to occupy a large amount of disk space. In this case you may want to set this to a lower number."

prowler/providers/azure/services/sqlserver/sqlserver_auditing_enabled/sqlserver_auditing_enabled.metadata.json

@@ -1,30 +1,37 @@
 {
   "Provider": "azure",
   "CheckID": "sqlserver_auditing_enabled",
-  "CheckTitle": "Ensure that SQL Servers have an audit policy configured",
+  "CheckTitle": "SQL Server has an auditing policy configured",
   "CheckType": [],
   "ServiceName": "sqlserver",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
-  "Severity": "medium",
-  "ResourceType": "SQLServer",
+  "Severity": "high",
+  "ResourceType": "microsoft.sql/servers",
   "ResourceGroup": "database",
-  "Description": "Ensure that there is an audit policy configured",
-  "Risk": "Audit policies are used to store logs associated to the SQL server (for instance, successful/unsuccesful log in attempts). These logs may be useful to detect anomalies or to perform an investigation in case a security incident is detected",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing",
+  "Description": "**Azure SQL Server** auditing is assessed at the server level to confirm audit logging is active. Configurations with any auditing policy state set to `Disabled` indicate auditing is not configured for the server and its databases.",
+  "Risk": "Without **SQL auditing**, visibility into logins, privilege changes, and query activity is lost. Stealthy data exfiltration and tampering can go undetected, impacting **confidentiality** and **integrity**. Absent audit trails hinder **forensics**, slow incident response, and weaken compliance evidence.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/is-is/azure/azure-sql/database/auditing-overview?view=azuresql&viewFallbackFrom=azuresql-vm",
+    "https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Sql/auditing.html"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "Set-AzureRmSqlServerAuditingPolicy -ResourceGroupName <RESOURCE_GROUP_NAME> -ServerName <SERVER_NAME> -AuditType <AUDIT_TYPE> -StorageAccountName <STORAGE_ACCOUNT_NAME>",
-      "NativeIaC": "",
-      "Other": "https://docs.prowler.com/checks/azure/azure-logging-policies/bc_azr_logging_2",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-logging-policies/bc_azr_logging_2#terraform"
+      "CLI": "az sql server audit-policy update --resource-group <RESOURCE_GROUP_NAME> --name <SERVER_NAME> --state Enabled --storage-account <STORAGE_ACCOUNT_NAME>",
+      "NativeIaC": "```bicep\n// Enable server-level auditing to an existing Storage Account\nparam sqlServerName string = \"<example_resource_name>\"\nparam storageAccountName string = \"<example_resource_name>\"\n\nresource sql 'Microsoft.Sql/servers@2021-11-01' existing = {\n  name: sqlServerName\n}\n\nresource sa 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {\n  name: storageAccountName\n}\n\nresource audit 'Microsoft.Sql/servers/auditingSettings@2021-11-01-preview' = {\n  name: 'default'\n  parent: sql\n  properties: {\n    state: 'Enabled' // Critical: turns on auditing\n    storageEndpoint: 'https://${sa.name}.blob.core.windows.net/' // Critical: audit log destination\n    storageAccountAccessKey: listKeys(sa.id, '2023-01-01').keys[0].value // Critical: grants write access to logs\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to SQL servers and select your server\n2. Under Security, click Auditing\n3. Set Auditing to On\n4. Select Storage as the destination and choose a Storage account\n5. Click Save",
+      "Terraform": "```hcl\n# Enable server-level auditing to Azure Storage\nresource \"azurerm_mssql_server_extended_auditing_policy\" \"<example_resource_name>\" {\n  server_id                  = \"<example_resource_id>\"\n  storage_endpoint           = \"https://<STORAGE_ACCOUNT_NAME>.blob.core.windows.net/\" # Critical: audit log destination\n  storage_account_access_key = \"<STORAGE_ACCOUNT_KEY>\"                                  # Critical: allows writing audit logs\n}\n```"
     },
     "Recommendation": {
-      "Text": "Create an audit policy for the SQL server",
-      "Url": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/Sql/auditing.html"
+      "Text": "Enable server-level **auditing** and send logs to a centralized, tamper-resistant store with defined retention. Enforce **least privilege** and **separation of duties** for log access, integrate with monitoring for alerts, and periodically validate coverage. Use database-level auditing only for specific exceptions.",
+      "Url": "https://hub.prowler.com/check/sqlserver_auditing_enabled"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""

prowler/providers/azure/services/sqlserver/sqlserver_auditing_retention_90_days/sqlserver_auditing_retention_90_days.metadata.json

@@ -1,30 +1,38 @@
 {
   "Provider": "azure",
   "CheckID": "sqlserver_auditing_retention_90_days",
-  "CheckTitle": "Ensure that 'Auditing' Retention is 'greater than 90 days'",
+  "CheckTitle": "SQL server has auditing enabled with retention greater than 90 days",
   "CheckType": [],
   "ServiceName": "sqlserver",
   "SubServiceName": "",
   "ResourceIdTemplate": "",
   "Severity": "medium",
-  "ResourceType": "SQLServer",
+  "ResourceType": "microsoft.sql/servers",
   "ResourceGroup": "database",
-  "Description": "SQL Server Audit Retention should be configured to be greater than 90 days.",
-  "Risk": "Audit Logs can be used to check for anomalies and give insight into suspected breaches or misuse of information and access.",
-  "RelatedUrl": "https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing",
+  "Description": "**Azure SQL Server auditing** settings are evaluated to ensure **auditing is enabled** and log retention is greater than `90` days. It considers the auditing policy state and the configured `retention_days` value.",
+  "Risk": "Without adequate retention or with auditing disabled, **activity trails expire too soon**, limiting detection and investigation of **unauthorized access, data exfiltration, and privilege abuse**. This weakens **confidentiality** and **integrity** and slows incident response.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/purview/audit-log-retention-policies",
+    "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Sql/auditing-retention.html#",
+    "https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing"
+  ],
   "Remediation": {
     "Code": {
-      "CLI": "Set-AzSqlServerAudit -ResourceGroupName resource_group_name -ServerName SQL_Server_name -RetentionInDays 100 -LogAnalyticsTargetState Enabled -WorkspaceResourceId '/subscriptions/subscription_ID/resourceGroups/insights-integration/providers/Microsoft.OperationalInsights/workspaces/workspace_name'",
-      "NativeIaC": "",
-      "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/Sql/auditing-retention.html#",
-      "Terraform": "https://docs.prowler.com/checks/azure/azure-logging-policies/bc_azr_logging_3"
+      "CLI": "Set-AzSqlServerAudit -ResourceGroupName <example_resource_name> -ServerName <example_resource_name> -RetentionInDays 91 -LogAnalyticsTargetState Enabled -WorkspaceResourceId <example_resource_id>",
+      "NativeIaC": "```bicep\n// Enable server-level auditing with retention > 90 days\nresource audit 'Microsoft.Sql/servers/auditingSettings@2021-02-01-preview' = {\n  name: '<example_resource_name>/default'\n  properties: {\n    state: 'Enabled'                         // Critical: turns auditing ON\n    retentionDays: 91                        // Critical: > 90 days\n    isAzureMonitorTargetEnabled: true        // Critical: send to Log Analytics\n    workspaceResourceId: '<example_resource_id>' // Critical: target workspace\n  }\n}\n```",
+      "Other": "1. In Azure Portal, go to SQL servers and select <example_resource_name>\n2. Under Security, click Auditing\n3. Set Auditing to On\n4. Destination: select Log Analytics workspace and choose your workspace\n5. Set Retention (days) to 91\n6. Click Save",
+      "Terraform": "```hcl\n# Enable server-level auditing with retention > 90 days\nresource \"azurerm_mssql_server_extended_auditing_policy\" \"audit\" {\n  server_id          = \"<example_resource_id>\"\n  log_monitoring_enabled = true   # Critical: enable Log Analytics target\n  retention_in_days      = 91     # Critical: > 90 days\n}\n```"
     },
     "Recommendation": {
-      "Text": "1. Go to SQL servers 2. For each server instance 3. Click on Auditing 4. If storage is selected, expand Advanced properties 5. Set the Retention (days) setting greater than 90 days or 0 for unlimited retention. 6. Select Save",
-      "Url": "https://learn.microsoft.com/en-us/purview/audit-log-retention-policies"
+      "Text": "Enable **server-level auditing** and set retention above `90` days, aligned with policy needs. Store logs in **tamper-resistant, centralized storage**, restrict access with **least privilege**, and integrate alerting and review. Apply **defense in depth** with continuous monitoring.",
+      "Url": "https://hub.prowler.com/check/sqlserver_auditing_retention_90_days"
     }
   },
-  "Categories": [],
+  "Categories": [
+    "logging",
+    "forensics-ready"
+  ],
   "DependsOn": [],
   "RelatedTo": [],
   "Notes": ""