17 December 2020

Database Drift – Monitoring Unauthorized Object Changes

by Grant Fritchey

5,300 0 Security

Metrics install automatically if you have Redgate Monitor installed.

If you are using Redgate’s SQL Server monitoring tool, Redgate Monitor, you can instantly install and run this metric on your servers.

This metric identifies when an object has been changed by other than the authorized login. It relies on an Extended Events session to capture the metrics and filters for a specific login. This is a tweak to this custom metric.

Here is the necessary Extended Events Session (substitute the appropriate login for the ‘LoginName’ string. Then start the session in order to use it with the custom metric.):

CREATE EVENT SESSION UnauthorizedObjectChanges
ON SERVER
ADD EVENT sqlserver.object_altered
(SET collect_database_name = (1)
ACTION
(
sqlserver.client_app_name,
sqlserver.server_principal_name,
sqlserver.session_id,
sqlserver.sql_text
)
WHERE (
package0.equal_uint64(ddl_phase, (1))
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')
AND package0.not_equal_uint64(object_type, (21587))
AND sqlserver.server_principal_name &lt;&gt; N'LoginName'
)
),
ADD EVENT sqlserver.object_created
(SET collect_database_name = (1)
ACTION
(
sqlserver.client_app_name,
sqlserver.server_principal_name,
sqlserver.session_id,
sqlserver.sql_text
)
WHERE (
package0.equal_uint64(ddl_phase, (1))
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')
AND package0.not_equal_uint64(object_type, (21587))
AND sqlserver.server_principal_name &lt;&gt; N'LoginName'
)
),
ADD EVENT sqlserver.object_deleted
(SET collect_database_name = (1)
ACTION
(
sqlserver.client_app_name,
sqlserver.server_principal_name,
sqlserver.session_id,
sqlserver.sql_text
)
WHERE (
package0.equal_uint64(ddl_phase, (1))
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')
AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')
AND package0.not_equal_uint64(object_type, (21587))
AND sqlserver.server_principal_name &lt;&gt; N'LoginName'
)
)
ADD TARGET package0.ring_buffer
GO

CREATE EVENT SESSION UnauthorizedObjectChanges

ON SERVER

ADD EVENT sqlserver.object_altered

(SET collect_database_name = (1)

ACTION

(

sqlserver.client_app_name,

sqlserver.server_principal_name,

sqlserver.session_id,

sqlserver.sql_text

)

WHERE (

package0.equal_uint64(ddl_phase, (1))

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')

AND package0.not_equal_uint64(object_type, (21587))

AND sqlserver.server_principal_name <> N'LoginName'

)

ADD EVENT sqlserver.object_created

(SET collect_database_name = (1)

ACTION

(

sqlserver.client_app_name,

sqlserver.server_principal_name,

sqlserver.session_id,

sqlserver.sql_text

)

WHERE (

package0.equal_uint64(ddl_phase, (1))

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')

AND package0.not_equal_uint64(object_type, (21587))

AND sqlserver.server_principal_name <> N'LoginName'

)

ADD EVENT sqlserver.object_deleted

(SET collect_database_name = (1)

ACTION

(

sqlserver.client_app_name,

sqlserver.server_principal_name,

sqlserver.session_id,

sqlserver.sql_text

)

WHERE (

package0.equal_uint64(ddl_phase, (1))

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'tempdb')

AND sqlserver.not_equal_i_sql_unicode_string(database_name, N'master')

AND package0.not_equal_uint64(object_type, (21587))

AND sqlserver.server_principal_name <> N'LoginName'

)

ADD TARGET package0.ring_buffer

Metric definition

Name

Unauthorized Object Changes

Description

This metric identifies when an object has been changed by other than the authorized login.

The T-SQL query that will collect data


		
			
			
Transact-SQL
			
			SELECT COUNT(*) AS ObjectsAltered
FROM sys.dm_xe_session_targets AS xet
INNER JOIN sys.dm_xe_sessions AS xes
ON xes.address = xet.event_session_address
CROSS APPLY
(SELECT CAST(xet.target_data AS XML)) AS target_data_xml(xml)
CROSS APPLY target_data_xml.xml.nodes('//RingBufferTarget/event') AS xed(event_data)
WHERE xes.name = 'UnauthorizedObjectChanges'
AND xet.target_name = 'ring_buffer'
AND DATEDIFF(
MINUTE,
CONVERT(
DATETIME2,
SWITCHOFFSET(
CONVERT(
DATETIMEOFFSET,
xed.event_data.value('(@timestamp)[1]', 'datetime2')
),
DATENAME(TzOffset, SYSDATETIMEOFFSET())
)
),
GETDATE()
) < 30; --metadata changes within the last thirty minutes
			
				
					
				
					1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
				
						SELECT COUNT(*) AS ObjectsAltered
FROM sys.dm_xe_session_targets AS xet
INNER JOIN sys.dm_xe_sessions AS xes
ON xes.address = xet.event_session_address
CROSS APPLY
(SELECT CAST(xet.target_data AS XML)) AS target_data_xml(xml)
CROSS APPLY target_data_xml.xml.nodes('//RingBufferTarget/event') AS xed(event_data)
WHERE xes.name = 'UnauthorizedObjectChanges'
AND xet.target_name = 'ring_buffer'
AND DATEDIFF(
MINUTE,
CONVERT(
DATETIME2,
SWITCHOFFSET(
CONVERT(
DATETIMEOFFSET,
xed.event_data.value('(@timestamp)[1]', 'datetime2')
),
DATENAME(TzOffset, SYSDATETIMEOFFSET())
)
),
GETDATE()
) < 30; --metadata changes within the last thirty minutes

Instances to collect from

Select all

Databases to collect from

Select all

Collection frequency

1 min

Use collected or calculated values

Leave the Use a calculated rate of change between collections check box unchecked

Metric collection

Enabled

Alert definition

Alert name

Unauthorized Object Changes

Description

Raise an alert when the metric value goes

Above the defined threshholds

Default threshold values

High:	0
Medium:
Low:

Raise an alert when the threshold is passed for

collections

Alert is

5,300 Rate

Click to rate this post!

[Total: 0 Average: 0]

Database Drift – Monitoring Unauthorized Object Changes

Metric definition

Name

Description

The T-SQL query that will collect data

Instances to collect from

Databases to collect from

Collection frequency

Use collected or calculated values

Metric collection

Alert definition

Alert name

Description

Raise an alert when the metric value goes

Default threshold values

Raise an alert when the threshold is passed for

Alert is

What are custom metrics?

What is Redgate Monitor?

Featured custom metrics

Total database file size

Number of active backups and restores

Full backup to odd path

Find metrics