EVID 33205 : SQL Audit Event
Classification
Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| EVID 33205 : SQL Audit Event | Base Rule | Object Operation | Other Audit Success |
| Table Deleted | Sub Rule | Object Deleted/Removed | Access Success |
| Server Role Dropped | Sub Rule | User Account Deleted | Account Deleted |
| Scalar Function Executed | Sub Rule | Command Executed | Access Success |
| Stored Procedure Executed | Sub Rule | Command Executed | Access Success |
| Synonym Executed | Sub Rule | Command Executed | Access Success |
| Security Policy Executed | Sub Rule | Command Executed | Access Success |
| Type Executed | Sub Rule | Command Executed | Access Success |
| Table Inserted | Sub Rule | Object Modified | Access Success |
| Index Login | Sub Rule | Login Or Logout Event Executed | Other Audit |
| Index Logout | Sub Rule | Session Closed | Other Audit Success |
| Synonym Selected | Sub Rule | Object Accessed | Access Success |
| Function Scalar Object Selected | Sub Rule | Object Accessed | Access Success |
| Tablet Selected | Sub Rule | Object Accessed | Access Success |
| View Selected | Sub Rule | Object Accessed | Access Success |
| Table Updated | Sub Rule | Object Modified | Access Success |
| Function Table-valued Object Selected | Sub Rule | Object Accessed | Access Success |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type |
|---|---|---|
| Name | <vendorinfo> | Text/String |
| Eventid | <vmid> | Number |
| Level | <severity> | Number |
| Computer | <sname> | Text/String |
| server_instance_name | <dname> | Text/String |
| server_principal_name | <login> | Text/String |
| target_server_principal_name | <account> | Text/String |
| session_id | <session> | Text/String |
| action_id | <sessiontype> | Text/String |
| database_name | <object> | Text/String |
| object name | <objectname> | Text/String |
| schema_name | <group> | Text/String |
| succeeded | <result> | Text/String |
| sequence_number | <quantity> | Number |
| action_id | <tag1> | Text/String |
| class_type | <tag2> | Text/String |
| database_principal_name | <tag3> | Text/String |