Netwrix Auditor for SQL Server Quick-Start Guide

1 NetwrixAuditorforSQLS erverQuick- ,anddoesnotconstituteacommitmentfromNetw rixCorporationofanyfeaturesorfunctions, , , ,ActiveDirectory,Exchange,ExchangeOnline ,Office365,SharePoint,SQLS erver,Windows, , ,therefore,itisrecommendedtoreaditsequen tially, :lInstallandconfigureNetwrixAuditorlCrea teamonitoringplantostartauditingaSQLS erverinstancelLaunchdatacollectionlSeeho wNetwrixAuditorenablescompletevisibility NOTE:Thisguideonlycoversthebasicconfigur ationandusageoptionsforauditingSQL ,aswellasforinformationonvariousreportin gpossibilitiesandotherproductfeatures, , ,ActiveDirectoryFederationServices,Azure AD,Exchange,Office365,Windowsfileservers ,EMCstoragedevices,NetAppfilerappliances ,NutanixFiles,networkdevices,SharePoint, OracleDatabase,SQLS erver,VMware,WindowsServer, , :lDetectinsiderthreats onpremisesandinthecloudlPasscomplianceau ditswithlesseffortandexpenselIncreasepro ductivityofITsecurityandoperationsteamsT olearnhowNetwrixAuditorcanhelpyourachiev eyourspecificbusinessobjectives, , , , , , :DatasourceSupportedVersionsSQL ServerlMicrosoftSQLS erver2019lMicrosoftSQLS erver2017lMicrosoftSQLS erver2016lMicrosoftSQLS erver2014lMicrosoftSQL Server2012lMicrosoftSQL Server2008R2lMicrosoftSQL Server2008 :6 ,thenumberofusersinyourenvironment, , , ,evaluation,orsmallenvironmentProcessor2 coresRAM4 GBDiskspace100GB Systemdrive100GB Datadrive(Long-TermArchiveandSQLS erver) :7 :lWindowsServer2019lWindowsServer2016lWi ndowsServer2012R2lWindowsServer2012 WindowsDesktopOS(64-bit) (seeSQLS erverReportingServices).

2 Ifyouplantoexportorprintsuchreports, , ,locateDownloads> , ,forexample, , , (orAdvancedServices) ,thenumberofusers, :AlthoughNetwrixAuditorprovidesaconvenie ntwaytodownloadSQLS erver2014 Expresseditionrightfromtheproduct, , :lTheaccountmustbeassignedtheDatabaseown er(db_owner) (domains,OUs,servers,etc.). ,theaccountmustmeetthecorrespondingrequi rements(seethetablebelow). ,youcanusegroupManagedServiceAccount(gMS A) ,thefollowingdatasourcesaresupported:Act iveDirectory(alsoforGroupPolicyandLogonA ctivity),WindowsServer,FileServer(curren tlyforWindowsFileServers),SQLS erver, ,seeUsingGroupManaged ServiceAccount(gMSA).ThegMSAshouldalsome ettherelatedrequirements(seethetablebelo w). , :SQLS erverForSQLS erverAuditing10 , , , , ,reliability, , ,NetwrixAuditorshortcutwillbeaddedtotheS tartmenu/screenandthe11 , ,notification, , ,tocollectdatafromyourenvironment, ,tothemonitoringplan, ,clicktheNewSQLS erverPlantileintheQuick ,specifytheaccountthatNetwrixAuditorwill usetoaccessthedatasource, , ,andinstructionsonhowtoconfigurethem, :IfyouwanttoauditnetworkdevicesorAzureAD /Office365infrastructure, ,alertingandreportingcapabilities, , , , :Alternatively,youcaninstructNetwrixAudi tornottostoredatatothedatabasesbutonlyto therepository(Long-TermArchive) inthisscenario, :lInstallanewinstanceofMicrosoftSQLS erverExpressautomatically :LocalSQLS erverinstanceisdetectedautomatically, :OptionDescriptionSQLS erverinstanceSpecifythenameoftheSQL :lWindowsauthenticationlSQLS erverauthentication14.

3 Thisaccountmustbegrantedthedatabaseowner (db_owner) , :15 , , <monitoring_plan_name>. ( ), , :Globalsettingsthatapplytoalldatabaseswi thauditdata(includingretentionperiodandS SRS serverusedforreporting) ServerSettingsWhenyoucreatethefirstmonit oringplan,youarepromptedtospecifytheemai lsettingsthatwillbeusedforactivityandhea lthsummaries, ,Netwrix16 ;however, :ActivitySummaryEmailonchangesinthemonit oredinfrastructure, , ,youshouldspecifytheobjects(items) ,forExchangedatasourcetheitemwillbeyourE xchangeserver,forWindowsServerdatasource -computer,IPrangeorADcontainer, , , :OptionDescriptionSpecifySQLS erverinstanceSpecifythenameoftheSQL , , , , yourmonitoringplan, , :Dependingonthesizeofthemonitoredenviron mentandthenumberofchanges, 'scurrentconfigurationstate, :Beforemakinganytestchangestoyourenviron ment,ensurethatyouhavethesufficientright s, ,makethefollowingtestchanges:lCreateadat abaselCreateastoredprocedure19 , :lReviewanActivitySummarylReviewOverview DashboardlReviewtheAllChangesReportlBrow seDatawithIntelligenceSearchInordernotto waitforascheduledActivitySummarygenerati on, , ,anActivitySummaryisgenerateddailyat3.

4 00AM ,checkyourmailboxforanActivitySummaryand seehowyourtestchangesarereported: ,objectattributes, ,user, Server , , ,makingtestchangestoyourenvironmentandru nningdatacollectionagain, , Predefined yourdatasourcetypeandprovideanarrowerins ightintowhatisgoingonintheauditedinfrast ructureandhelpyoustaycompliantwithvariou sstandardsandregulations(FISMA,HIPAA,PCI ,SOX,etc.).Aftercollectinginitialdata,ma kingtestchangestoyourenvironmentandrunni ngdatacollectionagain, ,navigatetoReports Predefined ,youarenotlimitedtoacertaindatasource,ch angetype, , ,makingtestchangestoyourenvironmentandru nningdatacollectionagain, ,navigatetoIntelligence , , , ( ,Who:AdministratorANDA ction:Added).lSpecifyseveralvaluesinthes amefiltertosearchforanyofthem( ,Action:ModifiedORAction:Removed).Todoth is, , ,selectExcludefromsearchintheDetailssect ionandspecifyafilter, , , , , , :24 , :DocumentDescriptionNetwrixAuditorOnline HelpCenterGathersinformationaboutNetwrix Auditorfrommultiplesourcesandstoresitino neplace, ,itssecurityintelligencefeatures,suchasi nteractivesearchandalerts, , ,report.