Microsoft SQL Server Audit

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/database-mssql-audit/generator.yml \
  --id mssql \
  --live-mode true

Event Types

Realism Features

• Session-correlated events — login creates a session reused by DML/DDL events, logout removes it, ensuring consistent user/IP/app context
• 5-host SQL Server fleet — production, reporting, staging, and dev instances with unique agent IDs and Windows Server OS metadata
• 13 SQL and Windows logins — sa, application service accounts, Windows domain users (CONTOSO\), and NT SERVICE accounts with weighted selection
• 6 databases with hierarchical schema/table/view/proc objects matching enterprise patterns (SalesDB, WebPortalDB, HR, CRM, DWH)
• Parameterized T-SQL statements — SELECT/INSERT/UPDATE/DELETE with @P1 parameters, schema-qualified object names
• Mixed authentication — SQL logins and Windows domain logins with proper user.domain extraction
• Failed logins with error XML — error codes 18456, states 2/5/7/8 in additional_information XML

Sample Output

{
  "@timestamp": "2026-03-06T14:22:31.456789+00:00",
  "event": {
    "action": "login-succeeded",
    "category": [
      "database",
      "authentication"
    ],
    "code": "33205",
    "dataset": "microsoft_sqlserver.audit",
    "kind": "event",
    "module": "microsoft_sqlserver",
    "outcome": "success",
    "type": [
      "connection",
      "start"
    ]
  },
  "sqlserver": {
    "audit": {
      "action_id": "LGIS",
      "class_type": "LX",
      "database_name": "master",
      "server_instance_name": "SQLPROD01\\MSSQLSERVER",
      "server_principal_name": "api_service",
      "session_id": 52,
      "succeeded": 1
    }
  },
  "user": {
    "name": "api_service"
  },
  "source": {
    "ip": "192.168.12.45",
    "port": 52134
  },
  "winlog": {
    "channel": "Security",
    "event_id": "33205"
  }
}

Parameters