SQLTriage

Overview

SQLTriage is a locally run SQL Server auditing and monitoring tool for senior DBAs, consultants, and security or compliance teams. Its strongest case is turning database checks into evidence-backed compliance reporting alongside operational views. Look elsewhere if you need hosted dashboards or broad database-platform coverage.

Key features

SQLTriage describes more than 576 checks spanning security, performance, configuration, high availability, backup, and recovery. Findings map to NIST 800-53, CIS Benchmarks, DISA STIG, ISO 27001, SOC 2, PCI-DSS, and HIPAA, with cited evidence and a board-ready PDF. The breadth of mappings is useful when database findings must be tied to control frameworks and presented beyond the DBA team.

Assessment checks query SQL Server DMVs without installing an agent or changing the database schema. That makes it a lower-impact option for assessment, but the read-only boundary applies to those checks: separate opt-in deployment and remediation pages can write changes. Connections support Windows Authentication, SQL Authentication, and Azure AD.

Companion views cover live sessions, blocking chains, query plans, wait stats, dashboards, and alerting. SQLWATCH can be used for long-term historical dashboards, complementing these monitoring views. The repository describes the app as local-only by default, without telemetry, phone-home, or cloud dependency, with optional Azure Blob export. SQL passwords are encrypted at rest using AES-256-GCM and DPAPI.

Pricing

SQLTriage is free: the Free plan costs nothing and includes all features, with no per-server fees, subscription, or feature tiers. There is no free trial because the tool is free. That removes server-count pricing and tier selection from the decision, while the GNU GPL v3 license permits commercial use but requires modifications to remain open.

Platforms

SQLTriage is offered as a Windows desktop app and in Windows Service mode; service dashboards are accessible from a browser via Kestrel HTTPS. It is self-hosted rather than a hosted SaaS dashboard product. SQL Server is its supported database; Azure SQL Managed Instance is fully supported, while Azure SQL Database support is partial and checks requiring server-level DMV access are skipped automatically.

Who it's for

Senior DBAs and database consultants get a combination of broad checks and operational views, while InfoSec and compliance teams can use framework mappings and cited findings for control-focused reporting. CIOs may value the board-ready PDF. It is less suitable for teams that need one hosted dashboard service or a tool spanning multiple database platforms.

Pros and cons

• Pros: More than 576 described checks, framework mappings, cited evidence, and PDF reporting give compliance work a clearer path from database condition to control-oriented communication.
• Pros: Agentless, schema-preserving assessment checks and local-only operation by default suit teams seeking a non-invasive, self-hosted assessment workflow.
• Pros: All features are free with no per-server fees or subscription, and the license allows commercial use.
• Cons: SQL Server focus rules it out as a general-purpose database auditing platform; Azure SQL Database coverage is partial.
• Cons: No hosted SaaS dashboards are offered, and SQLTriage's support route is GitHub Issues for bugs and feature requests or GitHub Discussions for community questions.
• Cons: GPL v3 requires modifications to remain open, which may not suit teams seeking to keep derivative changes closed.

Alternatives

For a narrower free SQL Server benchmark, consider the Free SQL Server Compliance Benchmark Tool, which offers over 80 checks and PDF benchmark output. Choose it when benchmark output is sufficient and SQLTriage's broader monitoring and framework-mapping scope is unnecessary.

Defensia Database Security is another option if Linux support or a freemium model matters; its free plan is limited to one server, 2,000 events per month, three days of log retention, and monitor mode. For cloud posture coverage, Onam Database Security offers a free plan for one cloud account and up to 500 resources, with core CSPM rules and CIS benchmark coverage.

Choose DBX when unlimited schema introspection, database topology, and local analysis are the priority rather than SQL Server compliance assessment. Oracle Cloud Infrastructure Secret Management is a separate option for managing secrets. Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM plan for external attack surface management. Omega DB Scanner Standalone is a free Windows scanner for Oracle databases. For enterprise DLP across endpoints, email, web, networks, and storage, consider Trellix Data Loss Prevention, with on-premises or SaaS management. Browse more options in Database Vulnerability Scanners.

Verdict

SQLTriage is a strong fit for teams responsible for SQL Server that need no-cost, agentless assessments with compliance mappings and cited reporting, plus monitoring views. Its breadth within SQL Server and unrestricted free feature set are the main reasons to choose it; its database focus and lack of hosted SaaS dashboards are the main reasons to look elsewhere.