{"name":"Unauthorized Object Changes","tsql":"SELECT COUNT(*) AS ObjectsAltered\r\nFROM sys.dm_xe_session_targets AS xet\r\nINNER JOIN sys.dm_xe_sessions AS xes\r\nON xes.address = xet.event_session_address\r\nCROSS APPLY\r\n(SELECT CAST(xet.target_data AS XML)) AS target_data_xml(xml)\r\nCROSS APPLY target_data_xml.xml.nodes('\/\/RingBufferTarget\/event') AS xed(event_data)\r\nWHERE xes.name = 'UnauthorizedObjectChanges'\r\nAND xet.target_name = 'ring_buffer'\r\nAND DATEDIFF(\r\nMINUTE,\r\nCONVERT(\r\nDATETIME2,\r\nSWITCHOFFSET(\r\nCONVERT(\r\nDATETIMEOFFSET,\r\nxed.event_data.value('(@timestamp)[1]', 'datetime2')\r\n),\r\nDATENAME(TzOffset, SYSDATETIMEOFFSET())\r\n)\r\n),\r\nGETDATE()\r\n) < 30; --metadata changes within the last thirty minutes","description":"This metric identifies when an object has been changed by other than the authorized login.","instances":true,"databases":{"mode":1},"frequency":60,"metricenabled":true,"alertname":"Unauthorized Object Changes","aboveorbelow":"above","_thresholds_high":{"selected":true,"value":0},"frequency_comment":"seconds (collected every minute)","rateofchange":false,"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"alertenabled":true,"targetentitytype":0}