COM-AX-001..007, Database scope, metadata and DMVs only (the agent has no
data access). An AX database is recognised by OBJECT_ID() of SQLDICTIONARY,
DATAAREA and SYSCONFIG, AX 3.0 by its 32-bit RECID, so the queries compile
and return nothing in every other database. SQL Server 2005 syntax.
- AX 3.0 out of support; AX 3.0 on SQL Server newer than 2005
- MAXDOP not 1 (server value before 2016, database scoped from 2016)
- tables without a unique RECID index (failed or partial synchronisation)
- large heaps (ClusterIndex not set in the AOT), statistics off
Tested against a mock AX 3.0 database and a plain database on SQL Server
2025, with QUOTED_IDENTIFIER both on and off (no XML methods).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Rules can now be data: a JSON file with one read-only SELECT where every
row is a finding, with {column} templates, server or per-database scope,
minimum version, sensitive columns and references. Community rules live
in rules/community (reviewed via pull request), ship with every build
and with the signed rule pack; local rules are read from the agent's
data folder every five minutes. Queries are checked for anything that
could write, run with the least-privilege login, and a missing
permission makes the rule not measurable rather than failing. The
rule engine picks up catalog changes without a restart. Authors get
'rules validate' and 'rules test --instance'. Four example community
rules (sa active, orphaned database owners, default trace off,
untrusted foreign keys).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
