mssql
October 17, 2024 · View on GitHub
Expression
product = "mssql"
Fields
| Field | Core | Detection | Informational |
|---|---|---|---|
| service_name | ✓ | ||
| local_user_name | |||
| fallback_user_name | |||
| dest_user | ✓ | ||
| src_host | ✓ | ✓ | |
| src_ip | ✓ | ||
| result | ✓ | ||
| db_name | ✓ | ✓ | |
| dest_domain_user_name | |||
| user_id | ✓ | ||
| event_code | ✓ | ||
| dest_domain | ✓ | ||
| dest_host | ✓ | ||
| event_name | ✓ | ||
| dest_user_id | ✓ | ||
| user | ✓ | ✓ |
Activity Types
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| database-delete | operation | ✓ | |||
| database-login | |||||
| database-query | schema_name | ✓ | |||
| table_name | Legacy | ✓ | |||
| operation | ✓ |