https://community.splunk.com/t5/Security/How-should-we-handle-SQL-Server-audit-data-that-reaches-the/m-p/516737#M11742 <P>For SQL Server audit information, we ended up sending the data to the wineventlog index as application events.</P><P>This data - EventCode=33205 should be visible only for the cyber/audit audience. How can we apply a different access to this data or should we route it to a different index? If so, how can we do it?</P> Fri, 28 Aug 2020 14:58:44 GMT danielbb 2020-08-28T14:58:44Z https://community.splunk.com/t5/Security/How-should-we-handle-SQL-Server-audit-data-that-reaches-the/m-p/516737#M11742 <P>For SQL Server audit information, we ended up sending the data to the wineventlog index as application events.</P><P>This data - EventCode=33205 should be visible only for the cyber/audit audience. How can we apply a different access to this data or should we route it to a different index? If so, how can we do it?</P> Fri, 28 Aug 2020 14:58:44 GMT https://community.splunk.com/t5/Security/How-should-we-handle-SQL-Server-audit-data-that-reaches-the/m-p/516737#M11742 danielbb 2020-08-28T14:58:44Z https://community.splunk.com/t5/Security/How-should-we-handle-SQL-Server-audit-data-that-reaches-the/m-p/516777#M11743 The only way to apply different security to certain data is to put that data in a separate index. Fri, 28 Aug 2020 17:13:20 GMT https://community.splunk.com/t5/Security/How-should-we-handle-SQL-Server-audit-data-that-reaches-the/m-p/516777#M11743 richgalloway 2020-08-28T17:13:20Z