Microsoft – Defender for Databases

Microsoft Defender for Databases, part of Microsoft Defender for Cloud, brings threat protection and security management to a database estate spanning four database types: Azure SQL databases, SQL Server running on virtual machines or physical servers, open-source relational databases including PostgreSQL and MySQL, and Azure Cosmos DB. The service detects anomalous activities that indicate unusual or potentially harmful attempts to access or exploit a database, so teams can address threats without needing to be database security experts or manage advanced monitoring systems themselves. Defender for Databases supports multicloud environments, covering Azure Database services for PostgreSQL and MySQL as well as Amazon RDS instances for Aurora PostgreSQL, Aurora MySQL, PostgreSQL, MySQL, and MariaDB, and for supported Amazon RDS databases it adds sensitive data discovery alongside threat detection. Alerts are enriched with threat intelligence and include details of the suspicious activity, the associated MITRE ATT&CK tactic, and recommended investigation and mitigation steps, with the option to continue the investigation in Microsoft Sentinel. Defender CSPM continuously evaluates configurations for Azure Database for PostgreSQL flexible server, surfacing misconfigurations alongside remediation guidance, and each protection plan is priced and enabled separately to match the databases in use.