Comments on: Audit SQL Server Jobs

By: Afzaal Aziz Awan

Afzaal Aziz Awan — Fri, 07 Oct 2022 11:24:37 +0000

It is a great explanation to Audit SQL Agent Job modifications, I would add [dbo].[sysschedules] to capture any changes in schedule

— I have put down my Audit script in below

USE [msdb]
GO
CREATE DATABASE AUDIT SPECIFICATION [MSD-Audit-Jobs]
FOR SERVER AUDIT [file name ????] — Setup a New Server Audit from Server->Security->Audit — and point to that file name
ADD (EXECUTE ON OBJECT::[dbo].[sp_add_job] BY [dbo]),
ADD (EXECUTE ON OBJECT::[dbo].[sp_update_job] BY [dbo]),
ADD (EXECUTE ON OBJECT::[dbo].[sp_delete_job] BY [dbo]),
ADD (DELETE ON OBJECT::[dbo].[sysjobs] BY [dbo]),
ADD (INSERT ON OBJECT::[dbo].[sysjobs] BY [dbo]),
ADD (UPDATE ON OBJECT::[dbo].[sysjobs] BY [dbo]),
ADD (DELETE ON OBJECT::[dbo].[sysschedules] BY [dbo]),
ADD (INSERT ON OBJECT::[dbo].[sysschedules] BY [dbo]),
ADD (UPDATE ON OBJECT::[dbo].[sysschedules] BY [dbo])
WITH (STATE = ON)
GO

By: Using sqlmap to Test For SQL Injection Vulnerabilities - Thomas LaRock

Using sqlmap to Test For SQL Injection Vulnerabilities - Thomas LaRock — Wed, 25 Oct 2017 14:07:01 +0000

[…] may have noticed my recent articles have had a security focus. I wrote one about using SQL Server Audit to track changes made to jobs inside of SQL Agent. And another on the SQL Vulnerability Assessment feature in Azure. Today I’m going […]

By: Azure Weekly: Oct 16, 2017 – Build Azure

Azure Weekly: Oct 16, 2017 – Build Azure — Mon, 16 Oct 2017 07:01:12 +0000

[…] Audit SQL Server Jobs by Thomas LaRock […]

By: Denis Gobo

Denis Gobo — Thu, 12 Oct 2017 19:23:00 +0000

In reply to ThomasLaRock. cool... enjoy the summit

By: ThomasLaRock

ThomasLaRock — Thu, 12 Oct 2017 19:10:00 +0000

In reply to Denis Gobo. Yessir, thanks! I plan on discussing that during my session at PASS this year, that you can incorporate this stuff as part of a standard build.

By: Denis Gobo

Denis Gobo — Thu, 12 Oct 2017 18:58:00 +0000

Also.. you can script all this stuff out from the wizard.. so you can save yourself a template of sorts and then just change some of the object names and this will save you lots of time in the future once you get it right once…

For example this was created after using wizards and clicking on the script button

USE [master]
GO

CREATE SERVER AUDIT [RockStarAudit]
TO FILE
( FILEPATH = N’Y:Data’
,MAXSIZE = 0 MB
,MAX_ROLLOVER_FILES = 2147483647
,RESERVE_DISK_SPACE = OFF
)
WITH
( QUEUE_DELAY = 1000
,ON_FAILURE = CONTINUE
,AUDIT_GUID = ‘0d3c98d4-56ad-446c-b4c7-aff25ee4d140’
)
ALTER SERVER AUDIT [RockStarAudit] WITH (STATE = OFF)
GO

USE [msdb]

CREATE DATABASE AUDIT SPECIFICATION [DatabaseAuditSpecification-20171012-145009]
FOR SERVER AUDIT [RockStarAudit]
ADD (EXECUTE ON OBJECT::[dbo].[sp_add_job] BY [dbo]),
ADD (UPDATE ON OBJECT::[dbo].[sysjobs] BY [dbo])

USE master
GO

ALTER SERVER AUDIT [RockStarAudit] WITH (STATE = ON)
GO