Detect MrbMiner Malware

VN:RO [1.9.17_1161]
Rating: 0.0/5 (0 votes cast)
0
85 0
This metric looks for the presence of the MrbMiner malware by checking for an account in sys.sql_logins. Additional information: https://www.zdnet.com/article/new-mrbminer-malware-has-infected-thousands-of-mssql-databases/ Read more

SQL Agent Jobs Owned By The Wrong Person

VN:RO [1.9.17_1161]
Rating: 0.0/5 (0 votes cast)
0
334 0
One or more SQL Agent jobs exist that are not owned by the database owner. You should fix these jobs so that they’re owned by the appropriate person. If the owning account is removed from Active Directory, the job may fail. Read more

Monitor Database Events

VN:RO [1.9.17_1161]
Rating: 5.0/5 (1 vote cast)
1
573 0 ,
This metric queries data from an Extended Events session to detect databases being dropped, created, started, stopped, attached or detached. It assigns a configurable “anxiety index” value (an integer from 1-10) to each detected event and then calculates a total based on the occurrences of these events over a period. First, create and start for […] Read more

Monitor TempDB Contention

VN:RO [1.9.17_1161]
Rating: 5.0/5 (2 votes cast)
2
1,250 0
Measures the total duration of latch waits on the tempdb database, in a one-minute time interval. First, create and start for the following Extended Events session on the monitored SQL Server instance: [crayon-5f66172d8e118803155997/] The goal is to get the total duration of latch waits, in the last minute, so this session collects all the event […] Read more

Monitoring Changes in Permissions, Users, Roles and Logins

VN:RO [1.9.17_1161]
Rating: 4.0/5 (5 votes cast)
5
2,340 0
Reports the number of changes to logins, users, roles in the past 10 minutes. It measures every change but doesn’t tell you if this is a drift from what it should be, since it might only be a permission being temporarily created and then revoked. First, create the following function in the database on the […] Read more