Event ID 33205 —

{
  "system": {
    "provider": "MSSQL$RADAR",
    "guid": "",
    "event_source_name": "",
    "event_id": 33205,
    "version": 0,
    "level": 0,
    "task": 5,
    "opcode": 0,
    "keywords": 45035996273704960,
    "time_created": "2020-11-24T09:14:16.167790+00:00",
    "event_record_id": 113202,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "mssql01.offsec.lan",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data": [
      "audit_schema_version:1\nevent_time:2020-11-24 09:14:11.6833666\nsequence_number:1\naction_id:AL  \nsucceeded:true\nis_column_permission:false\nsession_id:53\nserver_principal_id:2\ndatabase_principal_id:1\ntarget_server_principal_id:0\ntarget_database_principal_id:0\nobject_id:0\nuser_defined_event_id:0\nclass_type:DA\npermission_bitmask:00000000000000000000000000000000\nsequence_group_id:07DE5F90-9DA4-4653-AE58-F113BEAFD795\nsession_server_principal_name:OFFSEC\\admin-hacker\nserver_principal_name:OFFSEC\\admin-hacker\nserver_principal_sid:01050000000000051500000056d628fc05668f976f2456bb7b040000\ndatabase_principal_name:dbo\ntarget_server_principal_name:\ntarget_server_principal_sid:\ntarget_database_principal_name:\nserver_instance_name:MSSQL01\\RADAR\ndatabase_name:RCS-TEST-db\nschema_name:\nobject_name:db-audit-spec\nstatement:ALTER DATABASE AUDIT SPECIFICATION [db-audit-spec]\r\nWITH (STATE = OFF)\nadditional_information:\nuser_defined_information:\n"
    ]
  },
  "message": ""
}