Hello,
When Activity logs are exported to a Log Analytics Workspace (via Diagnostics Settings), the records are ingested in the table AzureActivity in the specified Log Analytics Workspace. (off-topic - you can ingest this type of data for free)
Now, to find all AzureActivity records that involves Delete operations, you can run this Kusto Query:
AzureActivity
| where OperationNameValue contains "delete"
For many operations, you might have a record when the operation is started and one with the status (success, failed,etc.)
If you want to see all the delete operations that completed successfully, you can run:
AzureActivity
| where OperationNameValue contains "delete"
| where ActivityStatusValue == "Success"
If you need a Kusto Query that presents just some info about the delete operations (to use as a source for report / dashboard / alert rule), you can use this:
AzureActivity
| where OperationNameValue contains "delete"
| where ActivityStatusValue == "Success"
| extend Temp = split(_ResourceId,'/')
| extend Deleted_Resource = Temp.[-1]
| extend Deleted_ResourceType = Temp.[-2]
| project TimeGenerated, Caller, CallerIpAddress, Deleted_Resource, Deleted_ResourceType, ResourceGroup
| order by TimeGenerated desc
I hope this is the answer you're looking for (if so, don't forget to mark as an answer).
Thank you!
BR,
George