{"name":"SuspiciousErrors","description":"Detects errors characteristic of a possible SQL Injection attack, or other attempts to gain illicit access to a database server. Returns the number of errors detected in the last 20 minutes.","tsql":"DECLARE @Target_Data XML =\r\n            (\r\n            SELECT TOP 1 Cast(xet.target_data AS XML) AS targetdata\r\n              FROM sys.dm_xe_session_targets AS xet\r\n                INNER JOIN sys.dm_xe_sessions AS xes\r\n                  ON xes.address = xet.event_session_address\r\n              WHERE xes.name = 'MonitorSuspiciousErrors'\r\n                AND xet.target_name = 'ring_buffer'\r\n            );\r\n  SELECT  Count(*) AS ErrorCount\r\n  FROM @Target_Data.nodes('\/\/RingBufferTarget\/event') AS xed (event_data)\r\n  WHERE DateDiff\r\n       ( MINUTE,Convert\r\n          (DATETIME2,\r\n            SwitchOffset(\r\n                Convert(DATETIMEOFFSET,xed.event_data.value('(@timestamp)[1]', 'datetime2')\r\n                       ),\r\n             DateName(TzOffset, SysDateTimeOffset())\r\n                        )\r\n             ),\r\n          GetDate()\r\n         ) <20;\r\n","instances":true,"databases":{"mode":2,"names":["master"]},"frequency":300,"rateofchange":false,"metricenabled":true,"alertname":"SuspiciousErrors","alertdescription":"Alert fires if the number of suspicious errors detected exceeds the defined threshold.","aboveorbelow":"above","_thresholds_medium":{"selected":true,"value":30},"alertenabled":true,"frequency_comment":"seconds (collected every 5 minutes)","_thresholds_high":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"targetentitytype":0}