FortiSIEM Microsoft SQL Server Scripts

Microsoft SQL Server Scripts

SQL Server Database Level Event Creation Script (PH_Database_Level_Events.sql)

SQL Server DDL Event Creation Script (PH_DDL_Server_Level_Events.sql)

CREATE TRIGGER PH_DDL_Server_Level_Events

ON ALL SERVER

 

FOR DDL_ENDPOINT_EVENTS, DDL_LOGIN_EVENTS, DDL_GDR_SERVER_EVENTS,

DDL_AUTHORIZATION_SERVER_EVENTS,

CREATE_DATABASE, ALTER_DATABASE, DROP_DATABASE

/**FOR DDL_SERVER_LEVEL_EVENTS**/

AS

DECLARE @eventData AS XML;

SET @eventData = EVENTDATA(); /**declare @eventData as XML; set @eventData = EVENTDATA();**/

insert into PH_Events.dbo.DDLEvents(EventTime, EventType, SPID, ServerName, LoginName, ObjectName, ObjectType, SchemaName, DatabaseName, CommandText, XMLEvent) values(cast(@eventData.query(‘data(//PostTime)’) as varchar(64)),        cast(@eventData.query(‘data(//EventType)’) as varchar(128)),        cast(@eventData.query(‘data(//SPID)’) as varchar(128)),        cast(@eventData.query(‘data(//ServerName)’) as varchar(128)),        cast(@eventData.query(‘data(//LoginName)’) as varchar(128)),        cast(@eventData.query(‘data(//ObjectName)’) as varchar(128)),        cast(@eventData.query(‘data(//ObjectType)’) as varchar(128)),        cast(@eventData.query(‘data(//SchemaName)’) as varchar(128)),        cast(@eventData.query(‘data(//DatabaseName)’) as varchar(64)),        cast(@eventData.query(‘data(//TSQLCommand/CommandText)’) as varchar(128)),      /**  DB_NAME(),**/

@eventData);

SQL Server Table Creation Script (PH_EventDB_Tables_Create.sql)

 

SQL Server Trigger Creation Script (PH_LogonEventsTrigger.sql)

This script is to create a server level trigger called PH_LoginEvents. It will record all logon events when a user establishes a session to the database server. The trigger locates at the database server > Server Objects > Triggers.

This entry was posted in Administration Guides, FortiSIEM on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

One thought on “FortiSIEM Microsoft SQL Server Scripts

  1. Dare

    Hi,
    In the configuration guide for Microsoft SQL, one of the steps says to save the sql server scripts attached to My Documents>SQL Server Management Studio>Projects. Where can these scripts be found? Thanks

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.