{"name":"ObjectsChanged","description":"Reports the number database object changes (create, alter or drop) in last 30 mins.","tsql":"SELECT Count(*) AS ObjectsAltered\r\n  FROM sys.dm_xe_session_targets AS xet\r\n    INNER JOIN sys.dm_xe_sessions AS xes\r\n      ON xes.address = xet.event_session_address\r\n    CROSS APPLY\r\n    (SELECT Cast(xet.target_data AS XML)) AS target_data_xml(xml)\r\n    CROSS APPLY target_data_xml.xml.nodes('\/\/RingBufferTarget\/event') AS xed(event_data)\r\n  WHERE xes.name = 'WhoChangedWhat'\r\n    AND xet.target_name = 'ring_buffer'\r\n    AND DateDiff\r\n      (MINUTE,\r\n      Convert(DATETIME2,\r\n              SwitchOffset(\r\nConvert(DATETIMEOFFSET,xed.event_data.value('(@timestamp)[1]', 'datetime2')),\r\n                DateName(TzOffset,SysDateTimeOffset()))\r\n            ),\r\n      GetDate()) < 30; --metadata changes within the last thirty minutes","instances":false,"databases":{"mode":1},"frequency":60,"rateofchange":false,"metricenabled":true,"alertname":"Database Drift has occurred","alertdescription":"Someone made unauthorized changes to database objects..","aboveorbelow":"above","_thresholds_high":{"selected":true,"value":1},"alertenabled":true,"frequency_comment":"seconds (collected every minute)","_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"targetentitytype":0}