{"description":"This custom metric queries the default trace to find events related to  whenever a login is added as a database user to a database.","name":"Database user added","tsql":"SELECT count(*)\r\nFROM sys.fn_trace_gettable(CONVERT(VARCHAR(150), (\r\n\t\t\t\tSELECT TOP 1 f.[value]\r\n\t\t\t\tFROM sys.fn_trace_getinfo(NULL) f\r\n\t\t\t\tWHERE f.property = 2\r\n\t\t\t\t)), DEFAULT) T\r\nINNER JOIN sys.trace_events e ON eventclass = trace_event_id\r\nINNER JOIN sys.trace_categories AS cat ON e.category_id = cat.category_id\r\nWHERE T.EventClass = 109 --Add DB User event\r\n\tAND T.EventSubClass = 3 --Add (4 = delete)\r\n\tAND T.DatabaseID = DB_ID()\r\n\tAND t.StartTime BETWEEN DATEADD(MINUTE, - 2, GETDATE())\r\n\t\tAND GETDATE()","databases":{"mode":1},"instances":true,"frequency":60,"metricenabled":true,"noalertremark":"You could add an alert once the baseline for your environment has been established.","rateofchange":false,"aboveorbelow":"above","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"alertenabled":true,"targetentitytype":0}