This condition evaluates to True when it finds databases with tables that have been modified with the past hour.
The results returned are number of tables in a database that meet the condition (Value) and the name of the database that has the modified tables (Key).
If the condition evaluates to True, run the following query against the database(s) in the result set to get a list of all tables modified today:
SELECT schema_name(schema_id), [name], modify_date, create_date
FROM sys.tables
WHERE modify_date >= (SELECT CONVERT(DATE,GETDATE()))
AND modify_date != create_date
ORDER by modify_date DESC;
An Execute SQL action can also be used to automatically email a list to you. See the sentryone-samples repo on GitHub for a sample you can use.
See Also:
https://docs.sentryone.com/help/github-advisory-conditions