SQL Server Audit Action Group: DATABASE_OBJECT_ACCESS_GROUP

We are unclear as to exactly what this action group audits. Microsoft documentation states "This event is raised whenever database objects such as message type, assembly, contract are accessed. This event is raised for any access to any database. Note this could potentially lead to large audit records."

At this time we recommend NOT enabling this group.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID	Description
24270	Issued reference database object permissions command
24271	Issued send service request command

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Server Audit Specification
•	Database Audit Specification
•	Audit Action Groups
•	Audit Actions
•	Audit Policy Wizard