Microsoft SQL Server Audit

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/database-mssql-audit/generator.yml \
  --id mssql \
  --live-mode true

Event Types

Realism Features

• Session-correlated events — login creates a session reused by DML/DDL events, logout removes it, ensuring consistent user/IP/app context
• 5-host SQL Server fleet — production, reporting, staging, and dev instances with unique agent IDs and Windows Server OS metadata
• 13 SQL and Windows logins — sa, application service accounts, Windows domain users (CONTOSO\), and NT SERVICE accounts with weighted selection
• 6 databases with hierarchical schema/table/view/proc objects matching enterprise patterns (SalesDB, WebPortalDB, HR, CRM, DWH)
• Parameterized T-SQL statements — SELECT/INSERT/UPDATE/DELETE with @P1 parameters, schema-qualified object names
• Mixed authentication — SQL logins and Windows domain logins with proper user.domain extraction
• Failed logins with error XML — error codes 18456, states 2/5/7/8 in additional_information XML

Sample Output

{
    "@timestamp": "2026-03-06T14:22:31.456789+00:00",
    "event": {
        "action": "login-succeeded",
        "category": ["database", "authentication"],
        "code": "33205",
        "dataset": "microsoft_sqlserver.audit",
        "kind": "event",
        "module": "microsoft_sqlserver",
        "outcome": "success",
        "type": ["connection", "start"]
    },
    "sqlserver": {
        "audit": {
            "action_id": "LGIS",
            "class_type": "LX",
            "database_name": "master",
            "server_instance_name": "SQLPROD01\\MSSQLSERVER",
            "server_principal_name": "api_service",
            "session_id": 52,
            "succeeded": 1
        }
    },
    "user": { "name": "api_service" },
    "source": { "ip": "192.168.12.45", "port": 52134 },
    "winlog": { "channel": "Security", "event_id": "33205" }
}

Parameters