{"name":"SELECT Statement executed against Classified table","description":"Uses Server and database audit to track SELECT statements","tsql":"DECLARE @auditFilePath VARCHAR(250) = (\r\n\t\tSELECT audit_file_path\r\n\t\tFROM sys.dm_server_audit_status\r\n\t\tWHERE name = 'Audit_Select_Statement'\r\n\t\t);\r\n\r\nSELECT count(*)\r\nFROM sys.fn_get_audit_file(@auditFilePath, DEFAULT, DEFAULT)\r\nWHERE action_id = 'SL'\r\n\tAND database_name = DB_NAME(DB_ID())\r\n\tAND event_time BETWEEN DATEADD(MINUTE, - 2, GETUTCDATE())\r\n\t\tAND GETUTCDATE()","databases":{"mode":1},"instances":true,"frequency":60,"metricenabled":true,"noalertremark":"You could add an alert once the baseline for your environment has been established.","rateofchange":false,"aboveorbelow":"above","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"alertenabled":true,"targetentitytype":0}