SQL Server Audit Tool

GDPR

General Data Protection Regulation. Track who accessed or modified personal data, with full login and timestamp accountability for data subject access requests.

HIPAA

Health Insurance Portability and Accountability Act. Maintain audit trails for patient record access with tamper-proof evidence and automatic alerts for unauthorized access.

SOX

Sarbanes-Oxley Act. Monitor privilege changes and administrative actions for financial data integrity. Track role changes, permission grants, and configuration modifications.

PCI DSS

Payment Card Industry Data Security Standard. Detect unauthorized access attempts, track authentication activity, and monitor cardholder data environments with configurable retention.

Data Changes

• SELECT, INSERT, UPDATE, DELETE tracking
• Per-instance toggle for each operation type
• Statement capture with execution metrics
• Minimum duration filter to reduce noise

Schema Changes

• CREATE, ALTER, DROP on all object types
• Track every change with the responsible user
• Database management operations (backup, restore)

Security & Authentication

• Login, Logout, and Failed Login tracking
• Permission changes (GRANT, DENY, REVOKE)
• Server configuration changes
• Role membership modifications

Filters & Scope

• Filter by database, login, application, or hostname
• Exclude system logins and internal applications
• Continuous collection with no gaps
• Configurable collection intervals

Security Summary

High-level overview of your audit posture with key metrics and risk indicators.

Anomaly Detection

Identify unusual patterns — off-hours access, bulk data operations, and privilege escalations.

Threat Analysis

Assess brute-force attempts, suspicious schema changes, and potential data exfiltration.

Recommendations

Actionable hardening suggestions based on your specific audit data and environment.

Real-Time Alerts

• Severity-based alerts: Critical, Warning, Info
• Alert acknowledgment with user tracking
• Dynamic badge counts on the Alerts tab
• Bulk acknowledge or individual triage
• Filter to show or hide acknowledged alerts

SIEM & Webhook Integration

• Splunk, Microsoft Sentinel, Elastic, QRadar
• Slack, Microsoft Teams, PagerDuty webhooks
• JSON and CEF (Common Event Format) output
• Per-endpoint enable/disable and test functionality
• Automatic failure tracking and health status
• Send test alerts to verify connectivity

How it works

• You run a one-time script on the target instance that creates a SERVER AUDIT with the action groups DBLense recognises (logins, principals, roles, permissions, backup/restore, audit changes).
• On on-prem / VM SQL Server, the audit writes to local .sqlaudit files (path you choose, e.g. C:\SQLAudit\).
• On Azure SQL Managed Instance, it writes .xel files to an Azure Blob container via SAS credential.
• The DBLense collector calls sys.fn_get_audit_file() over the same TCP 1433 connection it already uses — SQL Server reads the file or blob on our behalf.

What you get

• Tamper-evident security + backup trail recognised by external auditors
• Captures failed BACKUP / RESTORE attempts (not just successful ones)
• Captures every audit configuration change automatically (AUDIT_CHANGE_GROUP)
• Zero new moving parts in DBLense — same collector, same connection

Supported platforms

• SQL Server 2016+ (Standard, Enterprise, Developer) on Windows / Linux / VMs
• Azure SQL Managed Instance (General Purpose or Business Critical)
• Azure SQL Database — on roadmap (database-scoped audit differs)

Four-step install

1. Choose on-prem or Managed Instance install script
2. Edit path / blob URL + SAS at the top of the script
3. Run with sqlcmd -I -i install-server-audit-*.sql
4. Enable Use Server Audit on the instance in DBLense and paste the path

Full walkthrough, tuning, cost notes, and troubleshooting: Compliance Pack setup guide.

Integrity & chain of evidence

When the Compliance Pack is on, the collector records the source audit GUID and file/blob URI of every event it imports. Reports cite these back to SQL Server's own audit trail so reviewers can verify the chain — no “trust us” required.

• Events cross-linked to source .sqlaudit / .xel file
• Watermark-based collection — no duplicates, no gaps
• Append-only central table with configurable retention
• Central DB can itself sit on SQL 2022+ ledger tables if desired

PDF Compliance Reports

Generate polished PDF reports with a single click for internal reviews or external audits. Four pre-built report types aligned with common compliance requirements.

• Sensitive Data Access — Who accessed what data and when
• Permission Changes — Grant, deny, revoke actions and role changes
• Schema Changes — All structural modifications with the responsible user
• Failed Logins — Brute force indicators and auth failures
• Configurable period: 7, 30, 90, or 365 days
• CSV and PDF export from the Events tab

Enterprise

• Real-time monitoring across many instances
• Comprehensive auditing with minimal overhead
• Role-based access for compliance teams
• Tamper-evident audit trail via optional Compliance Pack (SQL Server Audit)
• SIEM integration for centralized security operations

Teams

• Deploy and configure within minutes
• Collect only relevant data to reduce overhead
• AI-powered analysis reduces manual triage
• Webhook alerts to Slack and Teams channels
• Multiple dashboards connected to one central database

Individual DBAs

• Register instances and start auditing in minutes
• Pre-configured event categories with recommendations
• One-click compliance reports for auditors
• AI insights without complex analysis
• Built-in diagnostics for troubleshooting