Onboarding MSSQL logs to Azure Sentinel-EventID:33205

Question

Hi there!

While Onboarding MSSQL logs from on-prem server to Azure Sentinel, we could see most of the logs under the event id: 33205.

1. Why all the logs are clubbed under Event id: 33205?
2. Is there a way , we can filter out the neccessary event from the Eventid: 33205?

Thanks in Advance

Answer 1

@Nafila Afrin Thanks for reaching out and apologies for delay on this.

1) Yes the logs do show up with same Event ID in most case, 33205, this is by design as All SQL audit events are generated with Event ID 33205
2) You can surely filter out the data with what you need on basis of actions something like this :

SQLEvent
| where LogonResult has "failed"
| summarize count() by CurrentUser, Reason

Check this for more customized KQL queries to understand how you can generate different insights :
https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-sql-server-with-azure-sentinel/ba-p/1502960

If you have a specific requirement which is not mentioned on that do let us know.

---

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Hi Vipul,

Thanks for the update. I would like to filter the events before we send the logs to sentinel using Azure Monitor agent DCR(custom x-path queries).

Do we have any sample database x-path queries for filtering MSSQL,MYSQL and Oracle Database logs before we send the logs to sentinel using Azure monitor agent DCR?

Thanks in avdvance!