Queries for the PurviewSecurityLogs table
For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.
Audit collection delete events
Display audit logs for collection delete events.
PurviewSecurityLogs
| where EntityType == 'Collections'
| where OperationName == 'Delete'
| take 100