Monitor MSSQL authentication with Splunk
Some MSSQL instance by default using “Network Service” to start MSSQL service. It will automatically generate both successful and failure logon from this account. It is advise not to explicit grant database permission to this service account, and monitoring other privilege account with database access.