Microsoft Defender for Cloud
Cloud and workloadsSimulate alerts for SQL servers on machines
In brief
The article updates terminology, clarifies the simulation flow and target machines, revises implementation details, and directs users to Security Alerts > Simulate Alerts with refreshed screenshots.
What Defender admins need to know
Administrators following the procedure should use the updated navigation and screenshots when running SQL alert simulations.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Simulate alerts for SQL servers on machines
Microsoft Defender for Cloud provides a SQL simulated alert simulation feature that helps organizations and security teams validate deploymentdeployments and test the preparedness of security teams detection, response, and automation workflows without creating actual security risks.
The simulation injects telemetry records on target machines (Azure Virtual Machines (VMs) or Arc-connected machines) throughuses a custom script extension named Sql-SimulateAlert. The to inject telemetry records on target machines. Target machines include Azure Virtual Machines (VMs) or Arc-connected machines. Each simulated alerts include fullalert includes runtime context such as host, SQL instance, database, and process information, so youinformation. You can use these alerts to validate your end-to-end security response flows. This process is safe and non-intrusive, ensuringdoesn't affect your resources remain secure.resources.
You can simulate the following security scenarios:
- Enable SQL Servers on Machines plan for Defender for Databases.
- Ensure that the target machine, whether a SQL VM or Arc‑connected machine, is successfully protected.
- Must have the following role and permission:
- Create an ARM deployment and
towrite VM extensions: Security Admin or Contributor in the target subscription. - Contributor permission and Resource Policy contributor to the resource
Microsoft.Compute/virtualMachines/writeandMicrosoft.Resources/deployments/*.
- Create an ARM deployment and
- The SQL Server instance must be configured to allow SQL Authentication for simulation scenarios that require a username and password (some simulation types accept user credentials).
Simulate alerts
The SqlAlertSimulationClient extracts template parametersreads details from the target resource, includingsuch as subscription, resource group, machine name, location, and the presence of the Defender extension. location.
SqlAlertSimulationClient or re-uses a custom script extension on the machine. The extension runs a PowerShell command that invokesstarts the Defender for SQL simulate helper with the requestedchosen attack parameters.settings. The helper generatescreates alert telemetry that flows intodata and sends it to Defender for Cloud, triggeringCloud. These alerts that downstreamcan then trigger your automation and mobilization connectors can consume.response connectors.
Sign in to the Azure portal.
Select Security > Microsoft Defender for Cloud.
Select the Security Alerts tab, and then select Simulate
alertAlerts.:::image type="content" source="media/simulate-alerts-sql-machines/simulate-sql-alert.png" alt-text="Screenshot
that shows whereof thesimulate alertMicrosoft Defender for SQL page with the Security Alerts tab and Simulate Alerts buttonis located.highlighted." lightbox="media/simulate-alerts-sql-machines/simulate-sql-alert.png":::Select an alert type.
Enter the required information for the selected alert type. For example, username and password for authentication attacks.
Select Simulate
AlertAlerts.
The alert appears after a few minutes and youminutes. You can use itthe alert to validate your security monitoring setup.
Verify that the alert is generated
Select Security > Microsoft Defender for Cloud.
Select the Security Alerts tab.
Select Check for alerts on this resource in Microsoft Defender for Cloud.
:::image type="content" source="media/simulate-alerts-sql-machines/check-
alerts.resource-alerts-in-defender-for-cloud.png" alt-text="Screenshotthat shows where to locateof theCheck for alerts on this resource inMicrosoft Defender for SQL page with the Security Alerts tab and the link to check the resource's alerts in Defender for Cloudbutton is located.highlighted." lightbox="media/simulate-alerts-sql-machines/check-alerts.resource-alerts-in-defender-for-cloud.png":::
Verify that the simulated alert appears in the list of alerts for the resource and manage and respond to the security alert.
Next step
@@ -2,16 +2,17 @@ title: Simulate alerts for SQL servers on machines description: Learn how to simulate alerts for SQL servers on machines in Microsoft Defender for Cloud. ms.topic: how-to-ms.date: 02/09/2026+ms.date: 07/03/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to simulate alerts for SQL servers on machines to test my security monitoring setup. ai-usage: ai-assisted --- # Simulate alerts for SQL servers on machines -Microsoft Defender for Cloud provides a SQL simulated alert feature that helps organizations and security teams validate deployment and test the preparedness of security teams detection, response, and automation workflows without creating actual security risks. +Microsoft Defender for Cloud provides a SQL alert simulation feature that helps organizations and security teams validate deployments and test detection, response, and automation workflows without creating actual security risks. -The simulation injects telemetry records on target machines (Azure Virtual Machines (VMs) or Arc-connected machines) through a custom script extension named `Sql-SimulateAlert`. The simulated alerts include full runtime context such as host, SQL instance, database, and process information, so you can validate your end-to-end security response flows. This process is safe and non-intrusive, ensuring your resources remain secure.+The simulation uses a custom script extension named `Sql-SimulateAlert` to inject telemetry records on target machines. Target machines include Azure Virtual Machines (VMs) or Arc-connected machines. Each simulated alert includes runtime context such as host, SQL instance, database, and process information. You can use these alerts to validate your end-to-end security response flows. This process is safe and doesn't affect your resources. You can simulate the following security scenarios: @@ -29,7 +30,7 @@ The simulation runs locally on the machine through the Custom Script Extension w - [Enable SQL Servers on Machines plan for Defender for Databases](defender-for-sql-usage.md). - [Ensure that the target machine, whether a SQL VM or Arc‑connected machine, is successfully protected](verify-machine-protection.md). - Must have the following role and permission: - - **Create an ARM deployment and to write VM extensions**: Security Admin or Contributor in the target subscription.+ - **Create an ARM deployment and write VM extensions**: Security Admin or Contributor in the target subscription. - Contributor permission and Resource Policy contributor to the resource `Microsoft.Compute/virtualMachines/write` and `Microsoft.Resources/deployments/*`. - The SQL Server instance must be configured to allow SQL Authentication for simulation scenarios that require a username and password (some simulation types accept user credentials). @@ -38,9 +39,9 @@ The simulation runs locally on the machine through the Custom Script Extension w ## Simulate alerts -The `SqlAlertSimulationClient` extracts template parameters from the target resource, including subscription, resource group, machine name, location, and the presence of the Defender extension. +The `SqlAlertSimulationClient` reads details from the target resource, such as subscription, resource group, machine name, and location. -`SqlAlertSimulationClient` builds an Azure Resource Manager (ARM) template that deploys or re-uses a custom script extension on the machine. The extension runs a PowerShell command that invokes the Defender for SQL simulate helper with the requested attack parameters. The helper generates alert telemetry that flows into Defender for Cloud, triggering alerts that downstream automation and mobilization connectors can consume.+It then builds an Azure Resource Manager (ARM) template that deploys a custom script extension on the machine. The extension runs a PowerShell command that starts the Defender for SQL simulate helper with the chosen attack settings. The helper creates alert data and sends it to Defender for Cloud. These alerts can then trigger your automation and response connectors. 1. Sign in to the [Azure portal](https://portal.azure.com/). @@ -54,9 +55,9 @@ The `SqlAlertSimulationClient` extracts template parameters from the target reso 1. Select **Security** > **Microsoft Defender for Cloud**. -1. Select **Simulate alert**.+1. Select the **Security Alerts** tab, and then select **Simulate Alerts**. - :::image type="content" source="media/simulate-alerts-sql-machines/simulate-alert.png" alt-text="Screenshot that shows where the simulate alert button is located." lightbox="media/simulate-alerts-sql-machines/simulate-alert.png":::+ :::image type="content" source="media/simulate-alerts-sql-machines/simulate-sql-alert.png" alt-text="Screenshot of the Microsoft Defender for SQL page with the Security Alerts tab and Simulate Alerts button highlighted." lightbox="media/simulate-alerts-sql-machines/simulate-sql-alert.png"::: 1. Select an alert type. @@ -64,9 +65,9 @@ The `SqlAlertSimulationClient` extracts template parameters from the target reso 1. Enter the required information for the selected alert type. For example, username and password for authentication attacks. -1. Select **Simulate Alert**.+1. Select **Simulate Alerts**. -The alert appears after a few minutes and you can use it to validate your security monitoring setup.+The alert appears after a few minutes. You can use the alert to validate your security monitoring setup. ## Verify that the alert is generated @@ -80,10 +81,12 @@ After you simulate an alert, verify that the alert is generated. 1. Select **Security** > **Microsoft Defender for Cloud**. -1. Select **Check for alerts on this resource in Microsoft Defender for Cloud**.+1. Select the **Security Alerts** tab. - :::image type="content" source="media/simulate-alerts-sql-machines/check-alerts.png" alt-text="Screenshot that shows where to locate the Check for alerts on this resource in Microsoft Defender for Cloud button is located." lightbox="media/simulate-alerts-sql-machines/check-alerts.png":::+1. Select **Check for alerts on this resource in Microsoft Defender for Cloud**. + :::image type="content" source="media/simulate-alerts-sql-machines/check-resource-alerts-in-defender-for-cloud.png" alt-text="Screenshot of the Microsoft Defender for SQL page with the Security Alerts tab and the link to check the resource's alerts in Defender for Cloud highlighted." lightbox="media/simulate-alerts-sql-machines/check-resource-alerts-in-defender-for-cloud.png":::+ Verify that the simulated alert appears in the list of alerts for the resource and [manage and respond to the security alert](manage-respond-alerts.md). ## Next step