Log analytics query to fetch any delete operations at azure subscription level

MS Techie 2,751 Reputation points
2023-02-09T15:21:59.57+00:00

We have configured Diagnostic settings at Azure subscripton level , to export all azure subscription level activity logs to Log analytics workspace.

How do we query using KQL to see if any "delete" operations happened. That is log operation should contain delete

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,666 questions
{count} votes

1 answer

Sort by: Most helpful
  1. George Moise 2,361 Reputation points Microsoft Employee
    2023-02-10T16:38:48.03+00:00

    Hello,

    When Activity logs are exported to a Log Analytics Workspace (via Diagnostics Settings), the records are ingested in the table AzureActivity in the specified Log Analytics Workspace. (off-topic - you can ingest this type of data for free)

    Now, to find all AzureActivity records that involves Delete operations, you can run this Kusto Query:

    AzureActivity
    | where OperationNameValue contains "delete"
    

    For many operations, you might have a record when the operation is started and one with the status (success, failed,etc.)

    If you want to see all the delete operations that completed successfully, you can run:

    AzureActivity
    | where OperationNameValue contains "delete"
    | where ActivityStatusValue == "Success"
    

    If you need a Kusto Query that presents just some info about the delete operations (to use as a source for report / dashboard / alert rule), you can use this:

    AzureActivity
    | where OperationNameValue contains "delete"
    | where ActivityStatusValue == "Success"
    | extend Temp = split(_ResourceId,'/')
    | extend Deleted_Resource = Temp.[-1]
    | extend Deleted_ResourceType = Temp.[-2]
    | project TimeGenerated, Caller, CallerIpAddress, Deleted_Resource, Deleted_ResourceType, ResourceGroup
    | order by TimeGenerated desc
    

    I hope this is the answer you're looking for (if so, don't forget to mark as an answer).

    Thank you!

    BR,

    George

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.