db.mssql_snare

Introduction

The tags beginning with db.mssql_snare identify events generated by Snare MSSQL.

Valid tags and data tables

The full tag must have 3 levels. The first two are fixed as db.mssql_snare. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables
Snare MSSQL	`db.mssql_snare.audit`	`db.mssql_snare.audit`

For more information, read more About Devo tags.

Table structure

These are the fields displayed in this table:

db.mssql_snare.audit

Field	Type	Field transformation	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
snare_time	`str`
snare_hostname	`str`
snare_application_id	`str`
snare_log_type	`str`
snare_criticality	`str`
start_time	`timestamp`
sql_version	`str`
event_id	`str`
event_class	`str`
spid	`str`
database_name	`str`	(isnull(database_name_aux) or isempty(database_name_aux)) ? action_database_name : database_name_aux	action_database_name database_name_aux
username	`str`	(isnull(username_aux) or isempty(username_aux)) ? action_username : username_aux	username_aux action_username
nt_username	`str`	(isnull(nt_username_aux) or isempty(nt_username_aux)) ? action_nt_username : nt_username_aux	nt_username_aux action_nt_username
application_name	`str`	(isnull(application_name_aux) or isempty(application_name_aux)) ? client_app_name : application_name_aux	application_name_aux client_app_name
transaction_id	`str`	(isnull(trans_id) or isempty(trans_id)) ? action_transaction_id : trans_id	trans_id action_transaction_id
event_hostname	`str`	(isnull(event_hostname_aux) or isempty(event_hostname_aux)) ? client_hostname : event_hostname_aux	event_hostname_aux client_hostname
event_timestamp	`timestamp`
session_login_name	`str`
num_response_rows	`str`
sql_text	`str`
session_server_principal_name	`str`
session_nt_username	`str`
server_principal_name	`str`
action_server_instance_name	`str`
database_id	`str`
task_time	`str`
last_error	`str`
event_sequence	`str`
collect_system_time	`str`
attach_activity_id_xfer	`str`
attach_activity_id	`str`
resource_type	`str`
resource_type_text	`str`
mode	`str`
mode_text	`str`
owner_type	`str`
owner_type_text	`str`
object_id	`str`
associated_object_id	`str`
resource_description	`str`
object_name	`str`
object_type	`str`
object_type_text	`str`
state	`str`
state_text	`str`
ddl_phase	`str`
ddl_phase_text	`str`
duration	`str`
statement	`str`
hostchain	`str`			✓
tag	`str`			✓
rawMessage	`str`			✓