Simulate alerts for SQL servers on machines

Microsoft Defender for Cloud provides a SQL alert simulation feature that helps organizations and security teams validate deployments and test detection, response, and automation workflows without creating actual security risks.

The simulation uses a custom script extension named Sql-SimulateAlert to inject telemetry records on target machines. Target machines include Azure Virtual Machines (VMs) or Arc-connected machines. Each simulated alert includes runtime context such as host, SQL instance, database, and process information. You can use these alerts to validate your end-to-end security response flows. This process is safe and doesn't affect your resources.

You can simulate the following security scenarios:

• Brute force authentication
• Authentication from suspicious application
• SQL injection
• Principal anomaly
• Shell external source anomaly
• Shell obfuscation

The simulation runs locally on the machine through the Custom Script Extension without executing external malicious payloads. All generated alerts contain complete machine and resource identifiers, SQL instance names, database information, process details, and telemetry data required by playbooks and security automation workflows.

Prerequisites

• Enable SQL Servers on Machines plan for Defender for Databases.

• Ensure that the target machine, whether a SQL VM or Arc‑connected machine, is successfully protected.

• Must have the following role and permission:

  • Create an ARM deployment and write VM extensions: Security Admin or Contributor in the target subscription.
  • Contributor permission and Resource Policy contributor to the resource Microsoft.Compute/virtualMachines/write and Microsoft.Resources/deployments/*.

• The SQL Server instance must be configured to allow SQL Authentication for simulation scenarios that require a username and password (some simulation types accept user credentials).

  Note

  Use an appropriate test SQL username and password rather than a production account.

Simulate alerts

The SqlAlertSimulationClient reads details from the target resource, such as subscription, resource group, machine name, and location.

It then builds an Azure Resource Manager (ARM) template that deploys a custom script extension on the machine. The extension runs a PowerShell command that starts the Defender for SQL simulate helper with the chosen attack settings. The helper creates alert data and sends it to Defender for Cloud. These alerts can then trigger your automation and response connectors.

1. Sign in to the Azure portal.

2. Search for and select Azure SQL.

3. Select SQL Server on Azure VMS or SQL Server instances (Azure Arc).

   

4. Select the relevant database.

5. Select Security > Microsoft Defender for Cloud.

6. Select the Security Alerts tab, and then select Simulate Alerts.

   

7. Select an alert type.

   

8. Enter the required information for the selected alert type. For example, username and password for authentication attacks.

9. Select Simulate Alerts.

The alert appears after a few minutes. You can use the alert to validate your security monitoring setup.

Verify that the alert is generated

After you simulate an alert, verify that the alert is generated.

1. In the Azure portal, search for and select Azure SQL.

2. Select SQL Server on Azure VMS or SQL Server instances (Azure Arc).

3. Select the relevant database.

4. Select Security > Microsoft Defender for Cloud.

5. Select the Security Alerts tab.

6. Select Check for alerts on this resource in Microsoft Defender for Cloud.

   

Verify that the simulated alert appears in the list of alerts for the resource and manage and respond to the security alert.

Next step