{
    "properties": {
        "displayName": "Audit Server level threat detection setting",
        "description": "Audit threat detection setting for SQL Server",
        "parameters": {
            "setting": {
                "type": "String",
                "allowedValues": [
                    "enabled",
                    "disabled"
                ],
                "metadata": {
                    "displayName": "Threat Detection Setting"
                }
            }
        },
        "policyRule": {
            "if": {
                "field": "type",
                "equals": "Microsoft.SQL/servers"
            },
            "then": {
                "effect": "auditIfNotExists",
                "details": {
                    "type": "Microsoft.SQL/servers/securityAlertPolicies",
                    "name": "default",
                    "existenceCondition": {
                        "allOf": [
                            {
                                "field": "Microsoft.Sql/securityAlertPolicies.state",
                                "equals": "[parameters('setting')]"
                            }
                        ]
                    }
                }
            }
        }
    }
}