Triggering of Defender for Database alerts

Question

Triggering of Defender for Database alerts

劉 0

We have enabled Defender for Database (at the resource level) for Azure Database for PostgreSQL flexible server.We would like to know if there is a specific testing method that can verify Defender for Database is working as expected. (Perform test actions → receive alerts in Defender for Cloud.)

Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-06-30T08:30:32.6666667+00:00
Hi @劉

Thank you for your question.

At present, Microsoft Defender for Databases for Azure Database for PostgreSQL Flexible Server does not provide a built-in "test alert" capability to verify that the service is working. Security alerts are generated only when Defender detects activity that matches its threat detection analytics, such as suspicious authentication attempts, anomalous access patterns, or other behaviors indicative of a potential attack.

To verify that Defender is configured correctly, first confirm that Microsoft Defender for Databases is enabled for your PostgreSQL Flexible Server and that the database is receiving normal client connections and workload, as Defender analyzes live database activity. You can then monitor Microsoft Defender for Cloud > Security alerts to see whether any detections are generated.

If you want to validate the end-to-end alerting process, the recommended approach is to perform controlled security testing in a non-production environment. For example, you can simulate benign suspicious behavior, such as repeated failed authentication attempts. However, please note that there is no guarantee that a specific action will trigger an alert, as detections are based on Microsoft's threat detection analytics, threat intelligence, and internal detection thresholds rather than predefined test events.

For more details, please refer to the following Microsoft documentation:

https://learn.microsoft.com/azure/defender-for-cloud/defender-for-databases-introduction

https://learn.microsoft.com/azure/defender-for-cloud/defender-for-databases-overview

I hope this helps. If you've confirmed that Defender is enabled and are still not seeing alerts after representative workload or controlled testing, please let us know, and we'll be happy to help review your configuration further.
Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-07-01T01:30:59.36+00:00

Hi @劉
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

1 answer

Your answer

Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-06-30T08:30:32.6666667+00:00

Hi @劉

Thank you for your question.

At present, Microsoft Defender for Databases for Azure Database for PostgreSQL Flexible Server does not provide a built-in "test alert" capability to verify that the service is working. Security alerts are generated only when Defender detects activity that matches its threat detection analytics, such as suspicious authentication attempts, anomalous access patterns, or other behaviors indicative of a potential attack.

To verify that Defender is configured correctly, first confirm that Microsoft Defender for Databases is enabled for your PostgreSQL Flexible Server and that the database is receiving normal client connections and workload, as Defender analyzes live database activity. You can then monitor Microsoft Defender for Cloud > Security alerts to see whether any detections are generated.

If you want to validate the end-to-end alerting process, the recommended approach is to perform controlled security testing in a non-production environment. For example, you can simulate benign suspicious behavior, such as repeated failed authentication attempts. However, please note that there is no guarantee that a specific action will trigger an alert, as detections are based on Microsoft's threat detection analytics, threat intelligence, and internal detection thresholds rather than predefined test events.

For more details, please refer to the following Microsoft documentation:

https://learn.microsoft.com/azure/defender-for-cloud/defender-for-databases-introduction

https://learn.microsoft.com/azure/defender-for-cloud/defender-for-databases-overview

I hope this helps. If you've confirmed that Defender is enabled and are still not seeing alerts after representative workload or controlled testing, please let us know, and we'll be happy to help review your configuration further.
Pilladi Padma Sai Manisha 10,770 Reputation points Microsoft External Staff Moderator

2026-07-01T01:30:59.36+00:00

Hi @劉
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer 1

Hi,

There is no out of the box Test flow button but you can try some of the usual steps like login with username and incorrect password so failed attempt to login should trigger. Access from unknown location like outside the configured network perimeter, SQL injection methods can be used so it can track and brute force with multiple devices conenctions.

Also check this Alerts and Dashboard view for all the alerts - https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-alerts

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.