Workaround
You can try the following query against each SQL database:
SELECT TOP (1000) [GroupID],[Data] FROM [MyChangeAuditor].[Configuration].[WebHookStatus]
- You will have to change the [MyChangeAuditor] to be the name of your CA database(s).
- Each of the line items will represent a different subscription that is setup in CA (SIEM and Threat Detection).
- The [GroupID] represents the GUID of the subscription itself, You can verify this by comparing the data on the Event Subscriptions page, if you expand the subscription the the Webhook Subscription ID should correlate to the entry.
- The data in the [DATA] field is actually the XML configuration that is used. The "<Enabled>0</Enabled>" or "<Enabled>1</Enabled>" lines in the XML denotes if the subscription is active or not.
