{"description":"This custom metric queries the default trace to find events related to creation of new Server Logins","name":"New Server Login Added","tsql":"SELECT COUNT(*) AS Result\r\nFROM sys.fn_trace_gettable(CONVERT(VARCHAR(150), (\r\n\t\t\t\tSELECT TOP 1 f.[value]\r\n\t\t\t\tFROM sys.fn_trace_getinfo(NULL) f\r\n\t\t\t\tWHERE f.property = 2\r\n\t\t\t\t)), DEFAULT) T\r\nINNER JOIN sys.trace_events e ON eventclass = trace_event_id\r\nINNER JOIN sys.trace_categories AS cat ON e.category_id = cat.category_id\r\nWHERE T.eventclass = 104 --AddLogin Event\r\n\tAND t.eventsubclass = 1 --Add (2==Drop)\r\n\tAND t.StartTime BETWEEN DATEADD(MINUTE, - 2, GETDATE())\r\n\t\tAND GETDATE()\r\n","frequency":60,"collections":60,"databases":{"mode":1},"metricenabled":true,"alertenabled":false,"noalertremark":"You could add an alert once the baseline for your environment has been established.","instances":true,"rateofchange":false,"aboveorbelow":"above","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"targetentitytype":0}