Without CONNECTION auditing, login attempts are invisible, weakening detection of brute-force, credential stuffing, and anomalous access. This enables unnoticed account takeover and lateral movement, impacting confidentiality and integrity, and hinders forensics and timely response.

Include CONNECTION in audit_log_events to capture login activity. Centralize and retain audit logs, restrict access by least privilege, and protect logs from tampering. Monitor for anomalous sign-in patterns and alert. Pair with defense-in-depth controls (MFA, network allow-listing) to reduce exposure.

• https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation
• https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/MySQL/configure-audit-log-events-for-mysql-flexible-servers.html