SQL Server auditing and security using EventLog Analyzer
This tutorial helps you navigate the capabilities of EventLog Analyzer in auditing, monitoring, and securing Microsoft SQL Server.
Before you start viewing the audit reports, enabling the detection rules, and generating compliance reports, ensure that you've enabled logging in your SQL Server and added it for auditing in the EventLog Analyzer console.
Auditing SQL Server using EventLog Analyzer: Use cases
EventLog Analyzer covers the below SQL Server auditing use cases with its security auditing reports. These reports are predefined and can be scheduled to be generated at a specific time and distributed over email.
| Use Case | Description | Why implement? | Available Reports |
|---|---|---|---|
| DDL change monitoring | Track all critical changes to SQL database structure including adding, altering tables, schemas, procedures, and views | Improves data security, aids troubleshooting, and enables rollbacks |
|
| DML change monitoring | Track and audit modifications to data stored in the SQL database. | Provides an audit trail for data modifications to ensure data integrity |
|
| User account auditing | Track changes to SQL Server user accounts such as user, login, password, and credential creation and deletion. | Enhances security by identifying suspicious activity and enforces accountability |
|
| SQL Server system auditing | Tracks events and activities across the database server, including server configuration changes, resource usage, and critical system failures. | Provides a comprehensive overview of system health, aids in security analytics, and helps identifying performance bottlenecks. |
|
| SQL Server error tracking | Audits errors encountered, including failure of backup, restoration, unexpected shutdown of the servers, and more. | Assists in troubleshooting database issues, provides visibility into problematic queries, and facilitates proactive maintenance. |
|
| User activity auditing | Track user activities within databases, including logins and modifications performed by each user. | Enhances security by detecting unauthorized accesses, modifications, or suspicious behaviors, and helps with compliance audits. |
|
Special auditing use cases: Account lockout analysis, audit log tampering, column integrity monitoring.
Securing SQL Server using EventLog Analyzer: Use cases
Threat detection
The below table lists the out-of-the-box threat detection use cases covered for SQL Sever by EventLog Analyzer. The solution also offers a custom correlation rule builder for creating detection rules by users. Please refer to the instructions here to build your own detection rules.
| Use Case | Event Type | Relevant MITRE ATT&CK TTPs | Detection Rules |
|---|---|---|---|
| SQL injection attack detection |
|
Initial Access: T1190 |
|
| Privilege abuse |
|
Privilege Escalation: T1068 |
|
| Denial of service attack detection |
|
Network Denial of Service: T1464 | Denial of service |
| Detecting access violation |
|
Account Manipulation: T1098 | Access violation |
| Detecting malicious access attempts |
|
Valid Accounts: T1078 | Successful non-trusted logins |
Data security
The below table elaborates the data security use cases covered by EventLog Analyzer for SQL Server.
| Use case | Event type | Relevant MITRE ATT&CK TTPs | Detection rules |
|---|---|---|---|
| Detecting unauthorized copies of sensitive data |
|
Data Manipulation: T1565 | Unauthorized copies of sensitive data |
| Unauthorized sensitive data modification |
|
Data Manipulation: T1565 | Integrity audit |
| Storage media exposure |
|
|
Storage media exposure |
Compliance use cases
Maintaining compliance goes beyond individual platforms. Auditing user activity isn't just for SQL Server, but for all devices, applications, and servers in your network. This table details how SQL Server's audit reports, rules, and alerts, analyzed by EventLog Analyzer, address specific compliance requirements. See the comprehensive solution mapping for a deeper dive.
Compliance requirement: Solution mapping for SQL Server
| EventLog Analyzer capabilities | Regulatory mandates | Requirements | |
|---|---|---|---|
| Summary reports and alerts | Rules | ||
|
Suspicious SQL backup activity | SOX | SEC 302 (a) (5) (A) |
|
|
ISLP |
|
| GDPR |
|
||
| NRC |
|
||
| Cyber Essentials |
|
||
| COCO |
|
||
| CCPA and CPRA | Section 1798.150.(a) | ||
| NERC |
|
||
| FERPA | Section 99.31 (a)(1)(ii) | ||
| PDPA |
|
||
| NIST CSF | Data Security (PR.DS) | ||
| CMMC |
|
||
| POPIA |
|
||
| QCF |
|
||
| TISAX |
|
||
| SAMA |
|
||
