SAP ASE (Sybase) Template
SAP ASE (Sybase) Controls
|
Action |
Subaction |
Condition |
| System Activity | ||
|
Fatal Errors |
User Switch |
EventID=36 |
|
Not Categorized |
Sybase |
.* |
|
System shutdown/Started |
System shutdown |
EventID=51 |
|
System shutdown |
System started |
EventID=50 |
| System Management | ||
| Audit Modification | Audit disabled | EventID=74 |
| Audit Modification | Audit enabled | EventID=73 |
| Audit Modification | Audit option change | EventID=78 |
| Audit Modification | Truncate audit table | EventIID-58 |
| Comandos (kill/terminate) | Comandos (kill/terminate) | EventID=89 |
| Database Administration | Alter Database | EventID=2 |
| Database Administration | Alter Table | EventID=3 |
| Database Administration | Create Database | EventID=9 |
| Database Administration | Create Default | EventID=14 |
| Database Administration | Create Index | EventID=104 |
| Database Administration | Create Message | EventID=15 |
| Database Administration | Create Procedure | EventID=11 |
| Database Administration | Create Rule | EventID=13 |
| Database Administration | Create SQLJ Function | EventID=97 |
| Database Administration | Create Table | EventID=10 |
| Database Administration | Create Trigger | EventID=12 |
| Database Administartion | Create View | EventID=16 |
| Database Administration | DBCC Command | EventID-81 |
| Database Administration | Delete Table | EventID-18 |
| Database Administration | Delete View | EventID=19 |
| Database Administration | Drop Database | EventID=26 |
| Database Administration | Drop Default | EventID=31 |
| Database Admnistation | Drop Index | EventID=105 |
| Database Administration | Drop Message | EventID=32 |
| Database Administration | Drop Procedure | EventID=28 |
| Database Administration | Drop Rule | EventID=30 |
| Database Administration | Drop SQLJ Function | EventID=98 |
| Database Administration | Drop Table | EventID=27 |
| Database Administration | Drop Trigger | EventID=29 |
| Database Administration | Drop View | EventID=33 |
| Database Administration | Dump Database | EventID=34 |
| Database Administration | Dump Transaction | EventID=35 |
| Database Administration | Insert Table | EventID=41 |
| Database Administration | Insert View | EventID=42 |
| Database Administration | Load Database | EventID=43 |
| Database Administration | Load Transaction | EventID=44 |
| Database Administration | Mount Database | EventID=101 |
| Database Administration | Truncate Table | EventID=64 |
| Database Administration | Unmount Database | EventID=102 |
| Database Administration | Update View | EventID=71 |
| User Activity | ||
| Logon Failure | Logon Failure | EventID=41, EventMod=2 |
| Succesful Login | Successful Login | EventID=45, EventMod=1 |
| User Statement | Cmdtext | EventID=92 |
| User Satement | Exec procedures | EventID=38 |
| User Statement | Exec trigger | EventID=39 |
| Users' Management | ||
| User addition to Group/Role/Profile | User Addition to Role | EventID=85. *grant role |
| Group/Role/Profile Modification | ADD Exclusive membershio | EventID=85.*ADD EXCLUSIVE |
| Group/Role/Profile/Modification | Command/Object/Column Added | EventID=40.*grant |
| Group/Role/Profile Modification | Command/Object/Column Dropped | EventID=47.*revoke |
| Group/Role/Profile Modification | DROP Exclusive membership | EventID=85.*DROP EXCLUSIVE |
| User Modification | Default Database | eventID=38.*objname: sp_defaultdb |
| User Modification | Max Failed Login | EventID=38.*objname: sp_modifylogin.*max failed_login |
| User Modification | Min Password Length | EventID=38.*objname: sp_modifylogin.*min passwd length |
| User Modification | Password Expiration interval | EventID=38.*objname: sp_modifylogin.*passwd expiration |
| Group/Role/Profile Creation | Role Creation | EventID=85.*CREATE ROLE |
| User Creation | User Creation | EVentID=38.*objname: sp_addlogin |
| Group/Role/Profile Deletion | Role Deletion | EventID=85.*DROP ROLE |
| User Deletion | User Deletion | EventID=38.*objname: sp_droplogin |
| Password Rest | Password Reset | EventID=38.*objname: sp_password |
| User Removal From Group/Role/Profile | User Removal from Role | EventID=85.*revoke role |
| User Lock | User Lock | EventID=38.*objname: sp_locklogin.*, lock |
| User Unloack | User Unlock | EventID=38.*objname: sp_locklogin.*unlock |