{"resources":{"mssql":{"id":"mssql","name":"mssql","fields":{"applicationRole":{"name":"applicationRole","type":"\u001bmssql.applicationRole","title":"SQL Server application role","desc":"A password-activated database principal not tied to any user. Applications activate the role with sp_setapprole to acquire the role's permissions for the session. Exposes the role's default schema, timestamps, and the permissions granted to it.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"asymmetricKey":{"name":"asymmetricKey","type":"\u001bmssql.asymmetricKey","title":"SQL Server asymmetric key","desc":"An asymmetric encryption key (sys.asymmetric_keys) defined within a database. `keyLength` reports the modulus size in bits, which the CIS benchmark checks against a minimum of 2048.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"audit":{"name":"audit","type":"\u001bmssql.audit","title":"SQL Server audit","desc":"A server audit object (sys.server_audits) that defines where audit records are written and how the instance behaves on audit failure. Audit specifications (`mssql.auditSpecification`) reference an audit by `name` to determine which events are captured.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"auditSpecification":{"name":"auditSpecification","type":"\u001bmssql.auditSpecification","title":"SQL Server audit specification","desc":"A server-level or database-level specification (sys.server_audit_specifications or sys.database_audit_specifications) that binds a set of audited actions to an audit. `auditName` names the parent audit, `isEnabled` reports whether the specification is active, and `details` lists the audited action groups.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"backup":{"name":"backup","type":"\u001bmssql.backup","title":"SQL Server backup record","desc":"A single backup set from the instance's backup history (msdb.dbo.backupset), selected by `backupSetUuid`. Reports the backup `type` (full, differential, or log), whether the backup set is encrypted (`isEncrypted` plus the `keyAlgorithm`), and the start and finish times. Auditing this surfaces databases whose backups are unencrypted.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"clrAssembly":{"name":"clrAssembly","type":"\u001bmssql.clrAssembly","title":"SQL Server CLR assembly","desc":"A managed-code assembly (sys.assemblies) registered in a database. `permissionSet` reports the trust level the assembly runs with; the CIS benchmark requires SAFE_ACCESS for all user assemblies, since EXTERNAL_ACCESS and UNSAFE grant the assembly access outside the database.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"credential":{"name":"credential","type":"\u001bmssql.credential","title":"SQL Server credential","desc":"A server-level credential (sys.credentials) that stores an identity and secret used to authenticate outside SQL Server, for example to a proxy account or an external resource. `mappedLogins` lists the logins this credential is attached to.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"database":{"name":"database","type":"\u001bmssql.database","title":"SQL Server database","desc":"A database hosted on the instance: a collection of schemas, database principals (users and roles), and securable objects. Exposes ownership (`ownerName`), security-relevant flags (`isTrustworthy`, `isEncrypted` for TDE, `containment`, `isAutoCloseOn`), and the database principals, permissions, scoped credentials, encryption keys, and CLR assemblies it contains. Selected by `name`, for example `mssql.server.databases.where(name == \"msdb\").first`.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"databaseRole":{"name":"databaseRole","type":"\u001bmssql.databaseRole","title":"SQL Server database role","desc":"A principal that bundles database-level permissions. Fixed roles such as db_owner, db_datareader, and public ship with every database (`isFixedRole`). Follow `members` for the users and roles granted the role.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"databaseScopedCredential":{"name":"databaseScopedCredential","type":"\u001bmssql.databaseScopedCredential","title":"Database-scoped credential","desc":"A credential defined within a single database (sys.database_scoped_credentials), used by that database to authenticate to external resources such as external data sources.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"databaseUser":{"name":"databaseUser","type":"\u001bmssql.databaseUser","title":"SQL Server database user","desc":"A principal scoped to a single database. Users may map to a server login, to a Windows account, or exist without a login (contained or loginless users). `login` resolves the mapped server login and is null for orphaned or loginless users, which is the signal for the CIS orphaned-user check. `authenticationType` distinguishes contained-database authentication (DATABASE) from instance authentication.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"linkedServer":{"name":"linkedServer","type":"\u001bmssql.linkedServer","title":"SQL Server linked server","desc":"A remote data source (sys.servers) that this instance can query through distributed queries. `linkedLogins` maps local logins to the remote credentials used when the link is traversed, and `isRpcOutEnabled` / `isDataAccessEnabled` gate what the link can do. Linked servers configured with a highly privileged self-mapping are a lateral-movement path.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"login":{"name":"login","type":"\u001bmssql.login","title":"SQL Server login","desc":"A server principal that can be granted server-level permissions and added to server roles. Logins are either local to the instance (`SQL_LOGIN`) or mapped to a Windows account or group (`WINDOWS_LOGIN`, `WINDOWS_GROUP`), or mapped to a certificate or asymmetric key. Select disabled or over-privileged logins, verify SQL-login password policy (`isPolicyChecked`, `isExpirationChecked`), and follow `databaseUsers` to see where a login lands inside databases.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"permission":{"name":"permission","type":"\u001bmssql.permission","title":"SQL Server permission grant","desc":"A single row from sys.server_permissions or sys.database_permissions describing a permission granted or denied to a principal. `state` is GRANT, DENY, or GRANT_WITH_GRANT, `permissionName` is the permission (for example CONTROL SERVER or CONNECT), and `class` names the securable class the permission applies to.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"proxyAccount":{"name":"proxyAccount","type":"\u001bmssql.proxyAccount","title":"SQL Server Agent proxy account","desc":"A proxy (msdb.dbo.sysproxies) that lets SQL Server Agent job steps run under a stored Windows credential. `authorizedLogins` lists the logins permitted to use the proxy and `subsystems` lists the job-step subsystems it is enabled for. Over-broad proxy authorization is a privilege-escalation path.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"server":{"name":"server","type":"\u001bmssql.server","title":"SQL Server instance","desc":"A single Microsoft SQL Server installation: the database engine that hosts databases and server-level objects. Exposes version and edition metadata, the authentication mode (`isMixedModeAuthEnabled`), transport hardening (`forceEncryption`, `extendedProtection`, `hideInstance`), the Windows service identity (`serviceAccount`, `servicePrincipalNames`), and the full set of server principals, permissions, databases, credentials, linked servers, proxy accounts, and audits. Surface-area sp_configure options are available through `configurations`.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"serverRole":{"name":"serverRole","type":"\u001bmssql.serverRole","title":"SQL Server role","desc":"A server principal that bundles server-level permissions. Fixed roles such as sysadmin, securityadmin, and public ship with the instance (`isFixedRole`); user-defined roles are created by administrators. Follow `members` for the logins and roles granted the role, and `explicitPermissions` for what the role itself is granted.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"symmetricKey":{"name":"symmetricKey","type":"\u001bmssql.symmetricKey","title":"SQL Server symmetric key","desc":"A symmetric encryption key (sys.symmetric_keys) defined within a database. `algorithm` and `keyLength` report the key's cipher and strength, which the CIS benchmark checks against a minimum of AES_128.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true}},"title":"Microsoft SQL Server","desc":"Root namespace for all Microsoft SQL Server resources. Query `mssql.server` for the connected instance: its version and edition, authentication mode, encryption settings, server principals (logins and roles), permissions, databases, credentials, linked servers, SQL Agent proxies, audit specifications, and surface-area configuration options.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.applicationRole":{"id":"mssql.applicationRole","name":"mssql.applicationRole","fields":{"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the role was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"defaultSchema":{"name":"defaultSchema","type":"\u0007","is_mandatory":true,"title":"Default schema used when the role is active","provider":"go.mondoo.com/mql/v13/providers/mssql"},"explicitPermissions":{"name":"explicitPermissions","type":"\u0019\u001bmssql.permission","title":"Database permissions granted or denied directly to this role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"memberOfRoles":{"name":"memberOfRoles","type":"\u0019\u001bmssql.databaseRole","title":"Database roles this application role is a direct member of","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the role was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application role name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"owningPrincipalId":{"name":"owningPrincipalId","type":"\u0005","is_mandatory":true,"title":"Principal id that owns the application role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Principal id within the database","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server application role","desc":"A password-activated database principal not tied to any user. Applications activate the role with sp_setapprole to acquire the role's permissions for the session. Exposes the role's default schema, timestamps, and the permissions granted to it.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.asymmetricKey":{"id":"mssql.asymmetricKey","name":"mssql.asymmetricKey","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm, for example RSA_2048","provider":"go.mondoo.com/mql/v13/providers/mssql"},"keyLength":{"name":"keyLength","type":"\u0005","is_mandatory":true,"title":"Key length in bits","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Key name","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server asymmetric key","desc":"An asymmetric encryption key (sys.asymmetric_keys) defined within a database. `keyLength` reports the modulus size in bits, which the CIS benchmark checks against a minimum of 2048.","min_provider_version":"13.0.0","defaults":"name algorithm","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.audit":{"id":"mssql.audit","name":"mssql.audit","fields":{"destination":{"name":"destination","type":"\u0007","is_mandatory":true,"title":"Destination of audit records: FILE, APPLICATION_LOG, or SECURITY_LOG","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the audit is currently running","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Audit name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"onFailure":{"name":"onFailure","type":"\u0007","is_mandatory":true,"title":"Behavior when a record cannot be written: CONTINUE, SHUTDOWN, or FAIL_OPERATION","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server audit","desc":"A server audit object (sys.server_audits) that defines where audit records are written and how the instance behaves on audit failure. Audit specifications (`mssql.auditSpecification`) reference an audit by `name` to determine which events are captured.","min_provider_version":"13.0.0","defaults":"name isEnabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.auditSpecification":{"id":"mssql.auditSpecification","name":"mssql.auditSpecification","fields":{"actionGroups":{"name":"actionGroups","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Audited action groups mapped to their state","desc":"Keys are audited action group names (for example SUCCESSFUL_LOGIN_GROUP or FAILED_LOGIN_GROUP) and values are the recorded audit-action state.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"auditName":{"name":"auditName","type":"\u0007","is_mandatory":true,"title":"Name of the audit this specification writes to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the specification is enabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Specification name","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server audit specification","desc":"A server-level or database-level specification (sys.server_audit_specifications or sys.database_audit_specifications) that binds a set of audited actions to an audit. `auditName` names the parent audit, `isEnabled` reports whether the specification is active, and `details` lists the audited action groups.","min_provider_version":"13.0.0","defaults":"name isEnabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.backup":{"id":"mssql.backup","name":"mssql.backup","fields":{"backupFinishDate":{"name":"backupFinishDate","type":"\t","is_mandatory":true,"title":"When the backup finished","provider":"go.mondoo.com/mql/v13/providers/mssql"},"backupSetUuid":{"name":"backupSetUuid","type":"\u0007","is_mandatory":true,"title":"Unique identifier of the backup set","provider":"go.mondoo.com/mql/v13/providers/mssql"},"backupStartDate":{"name":"backupStartDate","type":"\t","is_mandatory":true,"title":"When the backup started","provider":"go.mondoo.com/mql/v13/providers/mssql"},"databaseName":{"name":"databaseName","type":"\u0007","is_mandatory":true,"title":"Name of the database the backup was taken from","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isCopyOnly":{"name":"isCopyOnly","type":"\u0004","is_mandatory":true,"title":"Whether this is a copy-only backup","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isEncrypted":{"name":"isEncrypted","type":"\u0004","is_mandatory":true,"title":"Whether the backup set is encrypted","provider":"go.mondoo.com/mql/v13/providers/mssql"},"keyAlgorithm":{"name":"keyAlgorithm","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm, or empty when the backup is not encrypted","provider":"go.mondoo.com/mql/v13/providers/mssql"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Backup type, for example DATABASE, DIFFERENTIAL, LOG, or FILE","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server backup record","desc":"A single backup set from the instance's backup history (msdb.dbo.backupset), selected by `backupSetUuid`. Reports the backup `type` (full, differential, or log), whether the backup set is encrypted (`isEncrypted` plus the `keyAlgorithm`), and the start and finish times. Auditing this surfaces databases whose backups are unencrypted.","min_provider_version":"13.0.0","defaults":"databaseName type backupFinishDate","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.clrAssembly":{"id":"mssql.clrAssembly","name":"mssql.clrAssembly","fields":{"isUserDefined":{"name":"isUserDefined","type":"\u0004","is_mandatory":true,"title":"Whether the assembly is user-defined rather than a system assembly","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Assembly name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"permissionSet":{"name":"permissionSet","type":"\u0007","is_mandatory":true,"title":"Trust level: SAFE_ACCESS, EXTERNAL_ACCESS, or UNSAFE_ACCESS","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server CLR assembly","desc":"A managed-code assembly (sys.assemblies) registered in a database. `permissionSet` reports the trust level the assembly runs with; the CIS benchmark requires SAFE_ACCESS for all user assemblies, since EXTERNAL_ACCESS and UNSAFE grant the assembly access outside the database.","min_provider_version":"13.0.0","defaults":"name permissionSet","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.credential":{"id":"mssql.credential","name":"mssql.credential","fields":{"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"Identity (typically a Windows account) the credential authenticates as","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mappedLogins":{"name":"mappedLogins","type":"\u0019\u001bmssql.login","title":"Logins this credential is mapped to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server credential","desc":"A server-level credential (sys.credentials) that stores an identity and secret used to authenticate outside SQL Server, for example to a proxy account or an external resource. `mappedLogins` lists the logins this credential is attached to.","min_provider_version":"13.0.0","defaults":"name identity","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.database":{"id":"mssql.database","name":"mssql.database","fields":{"applicationRoles":{"name":"applicationRoles","type":"\u0019\u001bmssql.applicationRole","title":"Application roles defined in the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"asymmetricKeys":{"name":"asymmetricKeys","type":"\u0019\u001bmssql.asymmetricKey","title":"Asymmetric keys defined in the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"auditSpecifications":{"name":"auditSpecifications","type":"\u0019\u001bmssql.auditSpecification","title":"Database-level audit specifications","provider":"go.mondoo.com/mql/v13/providers/mssql"},"backups":{"name":"backups","type":"\u0019\u001bmssql.backup","title":"Backup history recorded for this database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"clrAssemblies":{"name":"clrAssemblies","type":"\u0019\u001bmssql.clrAssembly","title":"CLR assemblies registered in the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"collation":{"name":"collation","type":"\u0007","is_mandatory":true,"title":"Default collation of the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"compatibilityLevel":{"name":"compatibilityLevel","type":"\u0005","is_mandatory":true,"title":"Compatibility level, for example 160 for SQL Server 2022","provider":"go.mondoo.com/mql/v13/providers/mssql"},"containment":{"name":"containment","type":"\u0007","is_mandatory":true,"title":"Containment mode: NONE or PARTIAL","provider":"go.mondoo.com/mql/v13/providers/mssql"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the database was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"databaseId":{"name":"databaseId","type":"\u0005","is_mandatory":true,"title":"Database id within the instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isAutoCloseOn":{"name":"isAutoCloseOn","type":"\u0004","is_mandatory":true,"title":"Whether AUTO_CLOSE is on","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isBrokerEnabled":{"name":"isBrokerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Service Broker is enabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isEncrypted":{"name":"isEncrypted","type":"\u0004","is_mandatory":true,"title":"Whether Transparent Data Encryption (TDE) is enabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isReadOnly":{"name":"isReadOnly","type":"\u0004","is_mandatory":true,"title":"Whether the database is read-only","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isTrustworthy":{"name":"isTrustworthy","type":"\u0004","is_mandatory":true,"title":"Whether the TRUSTWORTHY property is on","desc":"When true, principals with control of the database can execute server-level actions in the context of the database owner, allowing privilege escalation if the owner is highly privileged.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"ownerName":{"name":"ownerName","type":"\u0007","is_mandatory":true,"title":"Name of the login that owns the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"ownerPrincipalId":{"name":"ownerPrincipalId","type":"\u0005","is_mandatory":true,"title":"Principal id of the database owner within the instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"ownerSid":{"name":"ownerSid","type":"\u0007","is_mandatory":true,"title":"Canonical SID (S-1-5-...) of the database owner","provider":"go.mondoo.com/mql/v13/providers/mssql"},"permissions":{"name":"permissions","type":"\u0019\u001bmssql.permission","title":"Database-level permissions (GRANT and DENY rows)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"roles":{"name":"roles","type":"\u0019\u001bmssql.databaseRole","title":"Database roles (fixed and user-defined)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"scopedCredentials":{"name":"scopedCredentials","type":"\u0019\u001bmssql.databaseScopedCredential","title":"Database-scoped credentials","provider":"go.mondoo.com/mql/v13/providers/mssql"},"stateDesc":{"name":"stateDesc","type":"\u0007","is_mandatory":true,"title":"Database state, for example ONLINE or OFFLINE","provider":"go.mondoo.com/mql/v13/providers/mssql"},"symmetricKeys":{"name":"symmetricKeys","type":"\u0019\u001bmssql.symmetricKey","title":"Symmetric keys defined in the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"users":{"name":"users","type":"\u0019\u001bmssql.databaseUser","title":"Database users","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server database","desc":"A database hosted on the instance: a collection of schemas, database principals (users and roles), and securable objects. Exposes ownership (`ownerName`), security-relevant flags (`isTrustworthy`, `isEncrypted` for TDE, `containment`, `isAutoCloseOn`), and the database principals, permissions, scoped credentials, encryption keys, and CLR assemblies it contains. Selected by `name`, for example `mssql.server.databases.where(name == \"msdb\").first`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.databaseRole":{"id":"mssql.databaseRole","name":"mssql.databaseRole","fields":{"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the role was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"explicitPermissions":{"name":"explicitPermissions","type":"\u0019\u001bmssql.permission","title":"Database permissions granted or denied directly to this role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isFixedRole":{"name":"isFixedRole","type":"\u0004","is_mandatory":true,"title":"Whether the role is a built-in fixed role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"memberOfRoles":{"name":"memberOfRoles","type":"\u0019\u001bmssql.databaseRole","title":"Roles this role is itself a direct member of","provider":"go.mondoo.com/mql/v13/providers/mssql"},"members":{"name":"members","type":"\u0019\u001bmssql.databaseUser","title":"Users and roles that are direct members of this role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the role was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name, for example db_owner or public","provider":"go.mondoo.com/mql/v13/providers/mssql"},"owningPrincipalId":{"name":"owningPrincipalId","type":"\u0005","is_mandatory":true,"title":"Principal id that owns the role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Principal id within the database","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server database role","desc":"A principal that bundles database-level permissions. Fixed roles such as db_owner, db_datareader, and public ship with every database (`isFixedRole`). Follow `members` for the users and roles granted the role.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.databaseScopedCredential":{"id":"mssql.databaseScopedCredential","name":"mssql.databaseScopedCredential","fields":{"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the credential was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"identity":{"name":"identity","type":"\u0007","is_mandatory":true,"title":"Identity the credential authenticates as","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the credential was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Credential name","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"Database-scoped credential","desc":"A credential defined within a single database (sys.database_scoped_credentials), used by that database to authenticate to external resources such as external data sources.","min_provider_version":"13.0.0","defaults":"name identity","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.databaseUser":{"id":"mssql.databaseUser","name":"mssql.databaseUser","fields":{"activeDirectoryPrincipal":{"name":"activeDirectoryPrincipal","type":"\u0007","is_mandatory":true,"title":"Name of the Active Directory principal the user maps to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"activeDirectorySid":{"name":"activeDirectorySid","type":"\u0007","is_mandatory":true,"title":"Canonical SID (S-1-5-...) of the Active Directory principal the user maps to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"authenticationType":{"name":"authenticationType","type":"\u0007","is_mandatory":true,"title":"Authentication scope: NONE, INSTANCE, DATABASE, or WINDOWS","provider":"go.mondoo.com/mql/v13/providers/mssql"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the user was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"defaultSchema":{"name":"defaultSchema","type":"\u0007","is_mandatory":true,"title":"Default schema used when the user connects","provider":"go.mondoo.com/mql/v13/providers/mssql"},"explicitPermissions":{"name":"explicitPermissions","type":"\u0019\u001bmssql.permission","title":"Database permissions granted or denied directly to this user","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isActiveDirectoryPrincipal":{"name":"isActiveDirectoryPrincipal","type":"\u0004","is_mandatory":true,"title":"Whether the user maps to an Active Directory principal","provider":"go.mondoo.com/mql/v13/providers/mssql"},"login":{"name":"login","type":"\u001bmssql.login","title":"Server login this user maps to","desc":"Null when the user has no matching login (an orphaned user) or was created without a login.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"memberOfRoles":{"name":"memberOfRoles","type":"\u0019\u001bmssql.databaseRole","title":"Database roles this user is a direct member of","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the user was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User name within the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Principal id within the database","provider":"go.mondoo.com/mql/v13/providers/mssql"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"Canonical SID (S-1-5-...) of the user","provider":"go.mondoo.com/mql/v13/providers/mssql"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"User type","desc":"One of SQL_USER, WINDOWS_USER, WINDOWS_GROUP, CERTIFICATE_MAPPED_USER, or ASYMMETRIC_KEY_MAPPED_USER.","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server database user","desc":"A principal scoped to a single database. Users may map to a server login, to a Windows account, or exist without a login (contained or loginless users). `login` resolves the mapped server login and is null for orphaned or loginless users, which is the signal for the CIS orphaned-user check. `authenticationType` distinguishes contained-database authentication (DATABASE) from instance authentication.","min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.linkedServer":{"id":"mssql.linkedServer","name":"mssql.linkedServer","fields":{"dataSource":{"name":"dataSource","type":"\u0007","is_mandatory":true,"title":"Data source (connection string endpoint) of the remote server","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isDataAccessEnabled":{"name":"isDataAccessEnabled","type":"\u0004","is_mandatory":true,"title":"Whether distributed queries against the link are permitted","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isRpcOutEnabled":{"name":"isRpcOutEnabled","type":"\u0004","is_mandatory":true,"title":"Whether outbound RPC is enabled on the link","provider":"go.mondoo.com/mql/v13/providers/mssql"},"linkedLogins":{"name":"linkedLogins","type":"\u0019\u001bmssql.linkedServer.login","title":"Local-to-remote login mappings for this link","provider":"go.mondoo.com/mql/v13/providers/mssql"},"login":{"name":"login","type":"\u001bmssql.linkedServer.login","title":"Linked-server login mapping","desc":"A single mapping (sys.linked_logins) from a local login to the credential used against the remote server. `usesSelfCredential` marks mappings that forward the caller's own login rather than a fixed remote account.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Linked server name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"product":{"name":"product","type":"\u0007","is_mandatory":true,"title":"Product name of the remote data source, for example SQL Server","provider":"go.mondoo.com/mql/v13/providers/mssql"},"provider":{"name":"provider","type":"\u0007","is_mandatory":true,"title":"OLE DB provider used to reach the remote source","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server linked server","desc":"A remote data source (sys.servers) that this instance can query through distributed queries. `linkedLogins` maps local logins to the remote credentials used when the link is traversed, and `isRpcOutEnabled` / `isDataAccessEnabled` gate what the link can do. Linked servers configured with a highly privileged self-mapping are a lateral-movement path.","min_provider_version":"13.0.0","defaults":"name product","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.linkedServer.login":{"id":"mssql.linkedServer.login","name":"mssql.linkedServer.login","fields":{"localLogin":{"name":"localLogin","type":"\u0007","is_mandatory":true,"title":"Local login the mapping applies to, or empty for the default mapping","provider":"go.mondoo.com/mql/v13/providers/mssql"},"remoteName":{"name":"remoteName","type":"\u0007","is_mandatory":true,"title":"Remote login name used against the linked server","provider":"go.mondoo.com/mql/v13/providers/mssql"},"usesSelfCredential":{"name":"usesSelfCredential","type":"\u0004","is_mandatory":true,"title":"Whether the caller's own credentials are forwarded to the remote server","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"Linked-server login mapping","desc":"A single mapping (sys.linked_logins) from a local login to the credential used against the remote server. `usesSelfCredential` marks mappings that forward the caller's own login rather than a fixed remote account.","min_provider_version":"13.0.0","defaults":"localLogin remoteName","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.login":{"id":"mssql.login","name":"mssql.login","fields":{"activeDirectoryPrincipal":{"name":"activeDirectoryPrincipal","type":"\u0007","is_mandatory":true,"title":"Name of the Active Directory principal the login maps to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"activeDirectorySid":{"name":"activeDirectorySid","type":"\u0007","is_mandatory":true,"title":"SID of the Active Directory principal the login maps to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the login was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"databaseUsers":{"name":"databaseUsers","type":"\u0019\u001bmssql.databaseUser","title":"Database users mapped to this login across databases","provider":"go.mondoo.com/mql/v13/providers/mssql"},"defaultDatabase":{"name":"defaultDatabase","type":"\u0007","is_mandatory":true,"title":"Default database the login connects to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"explicitPermissions":{"name":"explicitPermissions","type":"\u0019\u001bmssql.permission","title":"Server permissions granted or denied directly to this login","desc":"Direct grants only. Does not include permissions inherited through server role membership.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isActiveDirectoryPrincipal":{"name":"isActiveDirectoryPrincipal","type":"\u0004","is_mandatory":true,"title":"Whether the login maps to an Active Directory principal","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isDisabled":{"name":"isDisabled","type":"\u0004","is_mandatory":true,"title":"Whether the login is disabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isExpirationChecked":{"name":"isExpirationChecked","type":"\u0004","is_mandatory":true,"title":"Whether password expiration is enforced (CHECK_EXPIRATION)","desc":"Only meaningful for SQL_LOGIN principals. Null for Windows and mapped logins.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isFixedRole":{"name":"isFixedRole","type":"\u0004","is_mandatory":true,"title":"Whether this is a built-in fixed role masquerading as a principal","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isPolicyChecked":{"name":"isPolicyChecked","type":"\u0004","is_mandatory":true,"title":"Whether Windows password policy is enforced (CHECK_POLICY)","desc":"Only meaningful for SQL_LOGIN principals. Null for Windows and mapped logins, which do not carry a SQL-managed password.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"memberOfRoles":{"name":"memberOfRoles","type":"\u0019\u001bmssql.serverRole","title":"Server roles this login is a direct member of","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the login was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mustChange":{"name":"mustChange","type":"\u0004","is_mandatory":true,"title":"Whether the login must change its password at next login (MUST_CHANGE)","desc":"Only meaningful for SQL_LOGIN principals. Reads LOGINPROPERTY(name, 'IsMustChange'). Null for Windows and mapped logins.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Login name, for example CONTOSO\\sqladmin or sa","provider":"go.mondoo.com/mql/v13/providers/mssql"},"passwordLastSetTime":{"name":"passwordLastSetTime","type":"\t","is_mandatory":true,"title":"When the login's password was last set","provider":"go.mondoo.com/mql/v13/providers/mssql"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Principal id the instance uses to reference this login","provider":"go.mondoo.com/mql/v13/providers/mssql"},"sid":{"name":"sid","type":"\u0007","is_mandatory":true,"title":"Security identifier of the login","provider":"go.mondoo.com/mql/v13/providers/mssql"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Login type","desc":"One of SQL_LOGIN, WINDOWS_LOGIN, WINDOWS_GROUP, CERTIFICATE_MAPPED_LOGIN, or ASYMMETRIC_KEY_MAPPED_LOGIN.","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server login","desc":"A server principal that can be granted server-level permissions and added to server roles. Logins are either local to the instance (`SQL_LOGIN`) or mapped to a Windows account or group (`WINDOWS_LOGIN`, `WINDOWS_GROUP`), or mapped to a certificate or asymmetric key. Select disabled or over-privileged logins, verify SQL-login password policy (`isPolicyChecked`, `isExpirationChecked`), and follow `databaseUsers` to see where a login lands inside databases.","min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.permission":{"id":"mssql.permission","name":"mssql.permission","fields":{"class":{"name":"class","type":"\u0007","is_mandatory":true,"title":"Securable class, for example SERVER, DATABASE, or OBJECT_OR_COLUMN","provider":"go.mondoo.com/mql/v13/providers/mssql"},"granteeName":{"name":"granteeName","type":"\u0007","is_mandatory":true,"title":"Name of the principal the permission applies to","provider":"go.mondoo.com/mql/v13/providers/mssql"},"permissionName":{"name":"permissionName","type":"\u0007","is_mandatory":true,"title":"Permission name, for example CONTROL SERVER, IMPERSONATE, or CONNECT","provider":"go.mondoo.com/mql/v13/providers/mssql"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Grant state: GRANT, DENY, or GRANT_WITH_GRANT","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server permission grant","desc":"A single row from sys.server_permissions or sys.database_permissions describing a permission granted or denied to a principal. `state` is GRANT, DENY, or GRANT_WITH_GRANT, `permissionName` is the permission (for example CONTROL SERVER or CONNECT), and `class` names the securable class the permission applies to.","min_provider_version":"13.0.0","defaults":"permissionName state","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.proxyAccount":{"id":"mssql.proxyAccount","name":"mssql.proxyAccount","fields":{"authorizedLogins":{"name":"authorizedLogins","type":"\u0019\u001bmssql.login","title":"Logins authorized to use the proxy","provider":"go.mondoo.com/mql/v13/providers/mssql"},"credentialName":{"name":"credentialName","type":"\u0007","is_mandatory":true,"title":"Name of the credential the proxy runs under","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isAccessibleToPublic":{"name":"isAccessibleToPublic","type":"\u0004","is_mandatory":true,"title":"Whether the msdb public role can use this proxy","desc":"True when the public role in msdb is granted use of the proxy, which lets any login run job steps under the proxy's stored credential.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isEnabled":{"name":"isEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the proxy is enabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Proxy account name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"subsystems":{"name":"subsystems","type":"\u0019\u0007","is_mandatory":true,"title":"Job-step subsystems the proxy is authorized for, for example CmdExec or PowerShell","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server Agent proxy account","desc":"A proxy (msdb.dbo.sysproxies) that lets SQL Server Agent job steps run under a stored Windows credential. `authorizedLogins` lists the logins permitted to use the proxy and `subsystems` lists the job-step subsystems it is enabled for. Over-broad proxy authorization is a privilege-escalation path.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.server":{"id":"mssql.server","name":"mssql.server","fields":{"audits":{"name":"audits","type":"\u0019\u001bmssql.audit","title":"Server audits defined on the instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"configuration":{"name":"configuration","type":"\u001bmssql.server.configuration","title":"SQL Server configuration option","desc":"A single sp_configure server setting, keyed by `name` (for example \"clr enabled\", \"Ad Hoc Distributed Queries\", or \"default trace enabled\"). `valueInUse` is the running value and is what most surface-area audits should assert on, since `value` may be a pending change that has not been reconfigured. For example `mssql.server.configurations.where(name == \"clr enabled\").first.valueInUse`.","provider":"go.mondoo.com/mql/v13/providers/mssql","is_implicit_resource":true},"configurations":{"name":"configurations","type":"\u0019\u001bmssql.server.configuration","title":"Server configuration options from sp_configure","provider":"go.mondoo.com/mql/v13/providers/mssql"},"credentials":{"name":"credentials","type":"\u0019\u001bmssql.credential","title":"Server-level credentials","provider":"go.mondoo.com/mql/v13/providers/mssql"},"databases":{"name":"databases","type":"\u0019\u001bmssql.database","title":"Databases hosted on the instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"edition":{"name":"edition","type":"\u0007","is_mandatory":true,"title":"Product edition, for example Enterprise or Developer","provider":"go.mondoo.com/mql/v13/providers/mssql"},"errorLogFileCount":{"name":"errorLogFileCount","type":"\u0005","title":"Maximum number of SQL Server error log files retained","provider":"go.mondoo.com/mql/v13/providers/mssql"},"extendedProtection":{"name":"extendedProtection","type":"\u0007","title":"Extended Protection for Authentication (EPA) setting","desc":"One of Off, Allowed, or Required. Allowed and Required both defend against authentication relay to the instance. Null when the value cannot be read.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"forceEncryption":{"name":"forceEncryption","type":"\u0004","title":"Whether the server mandates client-side encryption (Force Encryption)","desc":"Reads the SuperSocketNetLib\\ForceEncryption registry value via xp_instance_regread. Null when the value cannot be read (for example on Linux or without sufficient privileges) rather than a misleading false.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"hideInstance":{"name":"hideInstance","type":"\u0004","title":"Whether the instance is hidden from SQL Browser broadcasts","desc":"Reads the SuperSocketNetLib\\HideInstance registry value via xp_instance_regread. Null when the value cannot be read.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"instanceName":{"name":"instanceName","type":"\u0007","is_mandatory":true,"title":"Instance name, or MSSQLSERVER for the default instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isClustered":{"name":"isClustered","type":"\u0004","is_mandatory":true,"title":"Whether the instance is part of a failover cluster","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isMixedModeAuthEnabled":{"name":"isMixedModeAuthEnabled","type":"\u0004","is_mandatory":true,"title":"Whether mixed-mode (SQL and Windows) authentication is enabled","desc":"True when both SQL logins and Windows logins may connect. False when only Windows authentication is permitted. Derived as the negation of SERVERPROPERTY('IsIntegratedSecurityOnly').","provider":"go.mondoo.com/mql/v13/providers/mssql"},"linkedServers":{"name":"linkedServers","type":"\u0019\u001bmssql.linkedServer","title":"Linked servers configured on this instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"loginAuditLevel":{"name":"loginAuditLevel","type":"\u0007","title":"Login auditing level","desc":"One of None, Failed, Successful, or All. Controls which login attempts are written to the SQL Server error log. Read from the AuditLevel registry value.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"logins":{"name":"logins","type":"\u0019\u001bmssql.login","title":"Server logins (SQL and Windows server principals)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"machineName":{"name":"machineName","type":"\u0007","is_mandatory":true,"title":"Windows host the instance runs on","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Configured instance name reported by SERVERPROPERTY('ServerName')","provider":"go.mondoo.com/mql/v13/providers/mssql"},"permissions":{"name":"permissions","type":"\u0019\u001bmssql.permission","title":"Server-level permissions (GRANT and DENY rows)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"port":{"name":"port","type":"\u0005","title":"TCP port the instance listens on","desc":"Read from sys.dm_exec_connections for the scanning session, so it is the port the instance actually accepts connections on rather than the port the scan dialed (they differ whenever a proxy or container port mapping sits in between). Falls back to the connection's port when the DMV is unavailable.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"productLevel":{"name":"productLevel","type":"\u0007","is_mandatory":true,"title":"Service pack or cumulative update level","provider":"go.mondoo.com/mql/v13/providers/mssql"},"productVersion":{"name":"productVersion","type":"\u0007","is_mandatory":true,"title":"Product version number, for example 16.0.1000.6","provider":"go.mondoo.com/mql/v13/providers/mssql"},"proxyAccounts":{"name":"proxyAccounts","type":"\u0019\u001bmssql.proxyAccount","title":"SQL Server Agent proxy accounts","provider":"go.mondoo.com/mql/v13/providers/mssql"},"roles":{"name":"roles","type":"\u0019\u001bmssql.serverRole","title":"Server roles (fixed and user-defined)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"serverAuditSpecifications":{"name":"serverAuditSpecifications","type":"\u0019\u001bmssql.auditSpecification","title":"Server-level audit specifications","provider":"go.mondoo.com/mql/v13/providers/mssql"},"serviceAccount":{"name":"serviceAccount","type":"\u0007","title":"Windows account the SQL Server service runs as","provider":"go.mondoo.com/mql/v13/providers/mssql"},"serviceAccountSid":{"name":"serviceAccountSid","type":"\u0007","title":"Security identifier of the SQL Server service account","desc":"Canonical SID (S-1-5-...) of the Windows service account, resolved via SUSER_SID. Null when the account cannot be resolved (for example on Linux or for a non-domain account). Use it to join the service account to an Active Directory principal.","provider":"go.mondoo.com/mql/v13/providers/mssql"},"servicePrincipalNames":{"name":"servicePrincipalNames","type":"\u0019\u0007","title":"Service principal names registered for this instance","provider":"go.mondoo.com/mql/v13/providers/mssql"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Full version banner from @@VERSION","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server instance","desc":"A single Microsoft SQL Server installation: the database engine that hosts databases and server-level objects. Exposes version and edition metadata, the authentication mode (`isMixedModeAuthEnabled`), transport hardening (`forceEncryption`, `extendedProtection`, `hideInstance`), the Windows service identity (`serviceAccount`, `servicePrincipalNames`), and the full set of server principals, permissions, databases, credentials, linked servers, proxy accounts, and audits. Surface-area sp_configure options are available through `configurations`.","min_provider_version":"13.0.0","defaults":"name version edition","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.server.configuration":{"id":"mssql.server.configuration","name":"mssql.server.configuration","fields":{"isAdvanced":{"name":"isAdvanced","type":"\u0004","is_mandatory":true,"title":"Whether the option is only visible with \"show advanced options\" enabled","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isDynamic":{"name":"isDynamic","type":"\u0004","is_mandatory":true,"title":"Whether the option takes effect without a server restart","provider":"go.mondoo.com/mql/v13/providers/mssql"},"maximum":{"name":"maximum","type":"\u0005","is_mandatory":true,"title":"Maximum permitted value","provider":"go.mondoo.com/mql/v13/providers/mssql"},"minimum":{"name":"minimum","type":"\u0005","is_mandatory":true,"title":"Minimum permitted value","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Option name as reported by sys.configurations","provider":"go.mondoo.com/mql/v13/providers/mssql"},"value":{"name":"value","type":"\u0005","is_mandatory":true,"title":"Configured value (may be pending a RECONFIGURE)","provider":"go.mondoo.com/mql/v13/providers/mssql"},"valueInUse":{"name":"valueInUse","type":"\u0005","is_mandatory":true,"title":"Currently running value","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server configuration option","desc":"A single sp_configure server setting, keyed by `name` (for example \"clr enabled\", \"Ad Hoc Distributed Queries\", or \"default trace enabled\"). `valueInUse` is the running value and is what most surface-area audits should assert on, since `value` may be a pending change that has not been reconfigured. For example `mssql.server.configurations.where(name == \"clr enabled\").first.valueInUse`.","min_provider_version":"13.0.0","defaults":"name valueInUse","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.serverRole":{"id":"mssql.serverRole","name":"mssql.serverRole","fields":{"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the role was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"explicitPermissions":{"name":"explicitPermissions","type":"\u0019\u001bmssql.permission","title":"Server permissions granted or denied directly to this role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"isFixedRole":{"name":"isFixedRole","type":"\u0004","is_mandatory":true,"title":"Whether the role is a built-in fixed role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"memberOfRoles":{"name":"memberOfRoles","type":"\u0019\u001bmssql.serverRole","title":"Roles this role is itself a direct member of","provider":"go.mondoo.com/mql/v13/providers/mssql"},"members":{"name":"members","type":"\u0019\u001bmssql.login","title":"Logins and roles that are direct members of this role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"modifyDate":{"name":"modifyDate","type":"\t","is_mandatory":true,"title":"When the role was last modified","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name, for example sysadmin or public","provider":"go.mondoo.com/mql/v13/providers/mssql"},"owningPrincipalId":{"name":"owningPrincipalId","type":"\u0005","is_mandatory":true,"title":"Principal id that owns the role","provider":"go.mondoo.com/mql/v13/providers/mssql"},"principalId":{"name":"principalId","type":"\u0005","is_mandatory":true,"title":"Principal id the instance uses to reference this role","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server role","desc":"A server principal that bundles server-level permissions. Fixed roles such as sysadmin, securityadmin, and public ship with the instance (`isFixedRole`); user-defined roles are created by administrators. Follow `members` for the logins and roles granted the role, and `explicitPermissions` for what the role itself is granted.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/mssql"},"mssql.symmetricKey":{"id":"mssql.symmetricKey","name":"mssql.symmetricKey","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Encryption algorithm, for example AES_256","provider":"go.mondoo.com/mql/v13/providers/mssql"},"createDate":{"name":"createDate","type":"\t","is_mandatory":true,"title":"When the key was created","provider":"go.mondoo.com/mql/v13/providers/mssql"},"keyLength":{"name":"keyLength","type":"\u0005","is_mandatory":true,"title":"Key length in bits","provider":"go.mondoo.com/mql/v13/providers/mssql"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Key name","provider":"go.mondoo.com/mql/v13/providers/mssql"}},"title":"SQL Server symmetric key","desc":"A symmetric encryption key (sys.symmetric_keys) defined within a database. `algorithm` and `keyLength` report the key's cipher and strength, which the CIS benchmark checks against a minimum of AES_128.","min_provider_version":"13.0.0","defaults":"name algorithm","provider":"go.mondoo.com/mql/v13/providers/mssql"}}}