MSSQL Server Database Connector User Guide

Instructions for deploying the MSSQL Server Database Connector to scan for cryptographic assets and deliver findings to the AgileSec Platform for processing and analysis.

Overview

The MSSQL Server Database Connector queries MSSQL views to determine the encryption state for all databases on the target SQL Server instance. For encrypted databases, this Connector captures the encryption method and algorithm, along with Data Encryption Key (DEK) details.

When Transparent Data Encryption (TDE) is enabled and protected by a certificate, the Connector also collects associated X.509 certificate metadata and other relevant cryptographic attributes. The Connector then sends these findings to Keyfactor’s AgileSec platform.

What Gets Scanned

The Connector queries the target SQL Server instance and evaluates all databases to identify encryption posture and related cryptographic assets, including:

• Database Encryption State: Whether each database is encrypted and its current encryption status.

• Encryption Method & Algorithm: Encryption type and configured algorithm (for example, TDE with AES-256).

• Data Encryption Key (DEK) Metadata: DEK creation details, including key/protector attributes and related fingerprints where available.

• Certificate & X.509 Metadata (TDE): When TDE is certificate-protected, captures associated X.509 certificate metadata (subject/issuer, validity dates, and certificate fingerprints).

• Database Context: Key instance/database attributes used to contextualize findings 

Prerequisites

Ensure you meet the following requirements to enable scanning.

SQL Server Database Requirements

Ensure the following requirements are met prior to configuring the MSSQL Server Database Connector:

Network Access

Remote Execution System Requirements

If running the Connector remotely using CLI, the remote execution machine must meet these requirements:

Remote Execution Access Requirements

Supported Authentication Methods

The MSSQL Server Database Connector supports Basic Auth and gMSA.

Basic Auth

When executing Platform Scans through the AgileSec Web UI or Remote Scan Executions, the MSSQL Connector can utilize SQL database username and password authentication.

gMSA (Remote Execution Only)

When executing Remote Scans, the MSSQL Server Database Connector supports Windows integrated authentication via a group Managed Service Account (gMSA). The Remote Connector must run under the gMSA security context. 

Running the Connector

AgileSec MSSQL Server Database Connector scans can be executed using the following methods:

1. Platform Scan Execution: Configure and execute scans directly through the Keyfactor AgileSec web UI with on-demand or scheduled execution options.

2. Remote Scan Execution: CrowdStrike Workflow. Deploy the Connector remotely and execute the Connector through a CrowdStrike workflow.

3. Remote Scan Execution: Windows. Deploy the Connector to a remote machine, configure the Connector, and execute using CLI. This approach is intended for environments where you manage execution directly on the Windows host. Remote Scan Execution enables running via Windows Task Scheduler (or an equivalent mechanism) instead of deploying and executing through a CrowdStrike workflow.

Platform Scan Parameters

Platform Scan Execution

Running scans through the user interface is the simplest and fastest way to get started. The platform enables running on-demand or scheduled scans in a dedicated environment.

Platform Scan Configuration

1. Open your browser and navigate to the Keyfactor AgileSec Platform Web URL

2. Log in with your credentials

3. Click on "Sensors" in the left navigation menu under Scan

   

4. Click "+ New Sensor".

   

5. Click on the correct card to open the configuration interface.

Configure Parameters and Start Scan

6. Fill in the required configuration parameters.

7. Click Save.

8. Click Action then Scan to begin a scan.
   Note: Click Edit to reconfigure parameters.

   

Remote Scan Execution: CrowdStrike Workflow

See MSSQL Connector CrowdStrike Workflow Execution for CrowdStrike Workflow Execution instructions.

Remote Execution Parameters

Remote Scan Execution: Windows

This approach is intended for environments where you manage execution directly on the Windows host. Use this method to configure and run the MSSQL Server Database Connector via Windows Task Scheduler (or an equivalent mechanism).

Scans may be run on remote host machines with the AgileSec Remote Sensor Package.

Download Remote Sensor Package

Generate Platform Token

7. In the Download Remote UI, click "Generate Token"

8. Copy the generated token

9. Store securely in an environment variable such as SENSOR_TOKEN:

    export SENSOR_TOKEN="your-generated-token"
   

Create Configuration File

Create a file named mssql.yml and populate it with the following example (update values to match your environment):

scan_config: plugins: - mssql - export
config:
  mssql:
    name: mssql
    plugin_config:
      app: "AgileSecSensor"
      log_level: "info"
      server: "127.0.0.1"
      port: 1433
      spn: ""          # Not currently supported. Leave empty
      trust: true      # Trust SQL Server TLS certificate (if applicable).
  export:
    name: export
    plugin_config:
      sensor_name: "SQL Server Database Sensor (admin)"
      sensor_type: "SQL Server Database Sensor"
      ran_by: "admin"
      url: "https://agilesec.kf-agilesec.com:8443"
      token: "${env:SENSOR_TOKEN}"
  settings: 
    log_level: "info" 
    allow_push: true 
    async_send: true

Step 4: Run the Connector

Execute the Connector with your configuration file:

• Windows (PowerShell)

  PowerShell

  # Set environment variables
  $env:SENSOR_TOKEN = "your-sensor-token"
  
  # Run Connector
  .\\unified_sensor_windows.exe -c .\\mssql.yml
  

Getting Support

Collect diagnostic information:

• Connector version

• Configuration file (redact tokens)

• Log output

• MSSQL details (versions, etc.)

Contact Support:

Contact Support

• Portal: https://support.keyfactor.com