Trigger: Detect & correct SQL servers with auditing disabled

select
  concat(id, ' [', subscription_id, '/', resource_group, ']') as title,
  name,
  resource_group,
  subscription_id,
  _ctx ->> 'connection_name' as conn
from
  azure_sql_server,
  jsonb_array_elements(server_audit_policy) audit
where
  audit -> 'properties' ->> 'state' = 'Disabled';