I'm looking for guidance on enabling SQL Server audit logging and getting the events into a SIEM. The SIEM is managed by a SOC, and I don't know which product they use.
How do I get SQL Server audit logs into a SIEM?
Asked by
w6!pktalign_305
Answers
Start by asking the SOC what they can ingest and how they want it delivered. Find out whether they have an agent or collector for SQL Server Audit, and whether they expect Windows event logs, audit files, or another format.
That answer will shape the setup. SQL Server Audit can write to audit files or to Windows event logs. You then create audit specifications for the server or databases and choose the actions you need to record. Test with a known event and have the SOC confirm that it arrived with enough detail to be useful.
Reply to this answer
Logbinder is one tool worth checking out for forwarding SQL Server audit data. Ask the SOC whether they support it before committing to a purchase. There may also be a way to use their existing collector instead.
Reply to this answer
Be selective about what you audit. Login activity, permission changes, and changes to sensitive data might matter, but the right choices depend on what the SOC needs to detect. Broad auditing can generate a lot of events, so check the volume and storage impact before rolling it out widely.
Reply to this answer
Add your answer
Answers are reviewed before publication.
u208~regmux_6:
Also ask about their retention and alerting requirements. Capturing an event and having the SOC monitor it are separate steps.