Azure SQL Database with Auditing Retention less than 90 days
This policy identifies SQL Databases that have Auditing Retention less than 90 days. Audit Logs can be used to check for anomalies and gives insight into suspected breaches or misuse of information and access. If server auditing is enabled, it always applies to the database. The database will be audited, regardless of the database auditing settings. It is recommended to configure SQL database Audit Retention to be greater than or equal to 90 days and leave the database-level auditing disabled for all databases.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If server auditing is enabled, it always applies to the database. The database will be audited, regardless of the database auditing settings. It is recommended that you enable only server-level auditing setting and leave the database-level auditing disabled for all databases.

To configure the Server level audit setting:
1. Log in to the Azure Portal
2. Go to SQL servers
3. Choose the reported each DB server
4. Select 'Auditing', and verify that 'Enable Azure SQL Auditing' is set
5. If Storage is selected, expand 'Advanced properties'
6. Set the Retention (days) setting is greater than 90 days or 0 for unlimited retention.
Note: The default value for the retention period is 0 (unlimited retention).
7. Click on 'Save'

It is recommended to avoid enabling both server auditing and database blob auditing together, unless; If you want to use a different storage account, retention period or Log Analytics Workspace for a specific database or want to use for audit event types or categories for a specific database that differ from the rest of the databases on the server.
To configure the Database level audit setting:
1. Log in to the Azure Portal
2. Go to SQL databases
3. Choose the reported each DB
4. Select 'Auditing', and verify that 'Enable Azure SQL Auditing' is set
5. If Storage is selected, expand 'Advanced properties'
6. Set the Retention (days) setting is greater than 90 days or 0 for unlimited retention.
Note: The default value for the retention period is 0 (unlimited retention).
7. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'azure-sql-server-list' AND json.rule = '(serverBlobAuditingPolicy does not exist or serverBlobAuditingPolicy is empty or serverBlobAuditingPolicy.properties.state equals Disabled or serverBlobAuditingPolicy.properties.retentionDays does not exist or (serverBlobAuditingPolicy.properties.storageEndpoint is not empty and serverBlobAuditingPolicy.properties.state equals Enabled and serverBlobAuditingPolicy.properties.retentionDays does not equal 0 and serverBlobAuditingPolicy.properties.retentionDays less than 90))' as X; config from cloud.resource where api.name = 'azure-sql-db-list' AND json.rule = '(blobAuditPolicy does not exist or blobAuditPolicy is empty or blobAuditPolicy.properties.retentionDays does not exist or (blobAuditPolicy.properties.storageEndpoint is not empty and blobAuditPolicy.properties.state equals Enabled and blobAuditPolicy.properties.retentionDays does not equal 0 and blobAuditPolicy.properties.retentionDays less than 90))' as Y; filter '$.Y.blobAuditPolicy.id contains $.X.sqlServer.name'; show Y;```