Randy F. Smith, an internationally recognized security expert, has a Recommended Report and Alert Designs document. This is for LOGbinder SQL[/url], but, together with the LOGbinder SQL event list, you might find it useful.

(LOGbinder SQL[/url] is a software to bridge the audit gap between SIEM and Microsoft SQL Server. It can read the SQL binary audit file and transform the raw and cryptic SQL audit events into actionable information, and sends these enriched audit messages to your SIEM, log-management or BDSA solution, using the best format for the target technology.)