Splunk Enterprise Security

MSSQL Server TA - audit events scalability over hundreds of DBs


According to
Audit events get written into a binary file C:\SQLAudit which then gets read via a DB connect query.
This is problematic when we need to monitor hundreds of different MSSQL Server DBs and would imply us setting up several HFs just for this tech stack alone (as well as very infrequent ingestion queries which doesn't seem a great fit for ES)

Even though writing audit events via Windows Event Log is less performsnt as it implies using the Windows event API rather than outputting to a file
I don't see any other option for us other than doing it and fetching via UF
This seems to have been the legacy approach for older TA versions

0 Karma


anyone please?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...