did you see this document? --> https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/ 26000/PD26553/en_US/SIEM-Collector-Produ…
Search in this document for: SQL Server C2 Audit
And not only seen, even reading ))
And almost know by heart )
I would want to see an example of someone so set up, because I do not do the logs in the ESM.