Thank you.

I am creating extended events like this. I want to capture like only drop, delete, truncate statements. How to add that predicate in addition to the db_id=5?

Create event session New_Audit on server

ADD EVENT sqlserver.sp_statement_completed(

ACTION(sqlserver.client_hostname,sqlserver.client_app_name,sqlserver.database_id,sqlserver.sql_text,sqlserver.username,sqlserver.task_time)

WHERE sqlserver.database_id = 5),

ADD EVENT sqlserver.sql_statement_completed(

ACTION(sqlserver.client_hostname,sqlserver.client_app_name,sqlserver.database_id,sqlserver.sql_text,sqlserver.username,sqlserver.task_time)

WHERE sqlserver.database_id = 5 )

ADD TARGET package0.event_file(SET filename = N'C:\AuditTesting.xel',

max_file_size=(50),max_rollover_files=(5))

alter event session New_Audit on server

state=start