Creating a Microsoft SQL Server database view

Create the dbo.AuditData database view to allow QRadar® to poll for audit events from a database table by using the JDBC protocol. The database view contains the audit events from your server audit specification and database audit specification.

1. From the Microsoft SQL Server Management Studio toolbar, click New Query.
2. Type the following Transact-SQL statement:

   create view dbo.AuditData as      SELECT * FROM sys.fn_get_audit_file     ('<Audit File Path and Name>',default,default);     GOa

   For example:

   create view dbo.AuditData as      SELECT * FROM sys.fn_get_audit_file     ('C:\inetpub\logs\SQLAudits*’,default,default);     GO

3. From the Standard toolbar, click Execute.