Microsoft SQL

OverviewResources

After Microsoft SQL Server is configured to deliver events to EventTracker, alerts, dashboards, and reports can be configured into EventTracker.

Security

Alerts

MSSQL:Audit created or deleted or modified– This alert is generated when audit, audit specification and extended event session are created, deleted or modified.
MSSQL:User enabled or disabled or unlocked– This alert is generated when an existing login is enabled, disabled or unlocked.

Reports

MSSQL-User enabled or disabled or unlocked– This report provides information related to login account enable, disable and unlock which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.
MSSQL-Extended event session created or deleted or modified– This report provides information related to extended event session creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Database backed up or restored– This report provides information related to database backup and restore which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.
MSSQL-Error details– This report provides information related to errors generated by SQL which includes Client Name, User Name, Client Application Name and Message fields. This report can also be co-related with Microsoft IIS-Suspicions SQL Injection report to detect SQL based attacks.

Operations

Alerts

MSSQL:Database created or deleted or modified– This alert is generated when a new database is created and older ones are deleted or modified.
MSSQL:Schema created or deleted or modified– This alert is generated when new database schema is created and older ones are deleted or modified.
MSSQL:View created or deleted or modified– This alert is generated when new database view is created and older ones are deleted or modified.
MSSQL:Stored procedure created or deleted or modified– This alert is generated when new stored procedure is created and older ones are deleted or modified.
MSSQL:Table created or deleted or modified– This alert is generated when new table is created and older ones are deleted, truncated or modified.
MSSQL:Index created or deleted or modified– - This alert is generated when new table view is created and older ones are deleted or modified.
MSSQL:Trigger created or deleted or modified– This alert is generated when new table or database trigger is created and older ones are deleted or modified.

Reports

MSSQL-Database created or deleted or modified- This report provides information related to database creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Table created or deleted or modified– This report provides information related to table creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Stored procedure created or deleted or modified– This report provides information related to stored procedure creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-View created or deleted or modified– This report provides information related to database view creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Index created or deleted or modified– This report provides information related to table index creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Trigger created or deleted or modified– This report provides information related to table and database trigger creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Schema created or deleted or modified– - This report provides information related to database schema creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name, Event Category, Object Name and Query Text fields.
MSSQL-Database backed up or restored– This report provides information related to database backup and restore which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.

Compliance

Alerts

MSSQL:Database and application role created or deleted or modified– This alert is generated when new server or database role is created and older ones are deleted or modified.
MSSQL:Permission granted or revoked or denied– This alert is generated when permission is granted, revoked or denied to a login or user.
MSSQL:User created or deleted or modified– This alert is generated when new login, user or credential is created and older ones are deleted or modified.
MSSQL:User logon failure– This alert is generated when an user fails to login SQL server.
MSSQL:User and application role password reset or changed– This alert is generated when password is changed or reset for login, credential or application role.

Reports

MSSQL-User and application role password reset or changed– This report provides information related to login, credential and application role creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.
MSSQL-Database and application role created or deleted or modified- This report provides information related to server, database and application role creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.
MSSQL-Permission granted or revoked or denied- This report provides information related to permission granted, revoked and denied to a user or login which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.
MSSQL-User logon success- This report provides information related to user logon success which includes Client Name, Client Address, User Name, Client Application Name and Authentication Type fields.
MSSQL-User logon failure- This report provides information related to user logon failure which includes Client Name, Client Address, User Name, Client Application Name and Failure Reason fields.
MSSQL-User created or deleted or modified- This report provides information related to login, user and credential creation, deletion and alteration which includes Client Name, User Name, Client Application Name, Database Name, Instance Name and Query Statement fields.

Scope

The configuration details are consistent with EventTracker version 9.x and later, and Microsoft SQL Server 2012 and later.

Documentation:

To configure Microsoft SQL server to send logs to EventTracker, refer the How to Guide.

For more information please refer the Integration guide

Solutions

Capabilities

Industries

Knowledge Center

Support

Microsoft SQL

Overview

Alerts

Reports

Alerts

Reports

Alerts

Reports

Scope

Documentation: