SQL Server Audit Log Alerting

There's no built-in security alerting in SQL Server.

(See our Recommended alert rules and reports for SQL Server auditing.)

However you could conceivably use SQL Profiler or a custom application to watch for SQL Server Events in the "Security Audit" category. Or you could decide to output SQL audit events to the Windows event log where you can create scheduled tasks or utilize other log monitoring tools to handle alerting.

Before attempting to build your own alerting engine I recommend you consider the issues identified in SQL Server Audit Log Reporting.

To allow SQL audit logs to be managed by your existing log management/SEIM and to obtain easy to understand, clearly formulated audit events, I designed LOGbinder for SQL Server.

 

Upcoming Webinars
    Additional Resources