{"name":"ConfigurationItemsChanged","description":"Reports the number of server or database configuration option changes in the past five minutes.","tsql":"SELECT Count(*) AS ErrorCount\r\n  FROM sys.dm_xe_session_targets AS xet\r\n    INNER JOIN sys.dm_xe_sessions AS xes\r\n      ON xes.address = xet.event_session_address\r\n    CROSS APPLY\r\n    (SELECT Cast(xet.target_data AS XML)) AS target_data_xml(xml)\r\n    CROSS APPLY target_data_xml.xml.nodes('\/\/RingBufferTarget\/event') AS xed(event_data)\r\n  WHERE xes.name = 'ConfigurationItemsChanged'\r\n    AND xet.target_name = 'ring_buffer'\r\n    AND DateDiff\r\n         (MINUTE, \r\n         Convert(DATETIME2,\r\n            SwitchOffset(\r\n            Convert(DATETIMEOFFSET, xed.event_data.value('(@timestamp)[1]', 'datetime2')),\r\n            DateName(TzOffset, SysDateTimeOffset())\r\n                        )\r\n            ), \r\n         GetDate()) < 5;","instances":false,"databases":{"mode":1},"frequency":60,"rateofchange":false,"metricenabled":true,"alertname":"Someone Changed a Server or Database Configuration Setting","alertdescription":"There have been more than 5 configuration changes in the last 5 minutes","aboveorbelow":"above","_thresholds_low":{"selected":true,"value":5},"alertenabled":true,"frequency_comment":"seconds (collected every minute)","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"collections":1,"targetentitytype":0}