{"name":"AccessControlChanges","description":"Reports the number of changes to logins, users, roles in the past 10 minutes. It measures every change but doesn't tell you if this is a drift from what it should be, since it might only be a permission being temporarily created and then revoked.","tsql":"SELECT \r\n    Count(*)\r\n   FROM::fn_trace_gettable(--just use the latest trace\r\n       (SELECT TOP 1 traces.path FROM sys.traces \r\n          WHERE traces.is_default = 1), DEFAULT) AS DT\r\n    WHERE StartTime > DateAdd (MINUTE, -10,SysDateTime())\r\n  AND TargetLoginName IS NOT NULL","instances":false,"databases":{"mode":1},"frequency":300,"rateofchange":false,"metricenabled":true,"alertname":"Change to a login, role or user","alertdescription":"There has been a change to a security principal. For example, a login has been added or removed, as a server login or database user, or has been added or removed from a fixed server role or database role, or a database.","aboveorbelow":"above","_thresholds_low":{"selected":true,"value":1},"alertenabled":true,"frequency_comment":"seconds (collected every 5 minutes)","_thresholds_high":{"selected":false},"_thresholds_medium":{"selected":false},"collections":1,"targetentitytype":0}