EVID 33205 : SQL Audit Event

Classification

Rule Name

Rule Type

Common Event

Classification

EVID 33205 : SQL Audit Event

Base Rule

Object Operation

Other Audit Success

Table Deleted

Sub Rule

Object Deleted/Removed

Access Success

Server Role Dropped

Sub Rule

User Account Deleted

Account Deleted

Scalar Function Executed

Sub Rule

Command Executed

Access Success

Stored Procedure Executed

Sub Rule

Command Executed

Access Success

Synonym Executed

Sub Rule

Command Executed

Access Success

Security Policy Executed

Sub Rule

Command Executed

Access Success

Type Executed

Sub Rule

Command Executed

Access Success

Table Inserted

Sub Rule

Object Modified

Access Success

Index Login

Sub Rule

Login Or Logout Event Executed

Other Audit

Index Logout

Sub Rule

Session Closed

Other Audit Success

Synonym Selected

Sub Rule

Object Accessed

Access Success

Function Scalar Object Selected

Sub Rule

Object Accessed

Access Success

Tablet Selected

Sub Rule

Object Accessed

Access Success

View Selected

Sub Rule

Object Accessed

Access Success

Table Updated

Sub Rule

Object Modified

Access Success

Function Table-valued Object Selected

Sub Rule

Object Accessed

Access Success

Mapping with LogRhythm Schema  

Device Key in Log Message

LogRhythm Schema

Data Type

Name

<vendorinfo>

Text/String

Eventid

<vmid>

Number

Level

<severity>

Number

Computer

<sname>

Text/String

server_instance_name

<dname>

Text/String

server_principal_name

<login>

Text/String

target_server_principal_name

<account>

Text/String

session_id

<session>

Text/String

action_id

<sessiontype>

Text/String

database_name

<object>

Text/String

object name

<objectname>

Text/String

schema_name

<group>

Text/String

succeeded

<result>

Text/String

sequence_number

<quantity>

Number

action_id

<tag1>

Text/String

class_type

<tag2>

Text/String

database_principal_name

<tag3>

Text/String