Azure Log Analytic Table Operation Audit

This query is designed to audit write and delete actions on Azure Log Analytics Workspace (LAW) tables. Here's a simple breakdown of what it does:

1. Data Source: It uses the AzureActivity table, which logs various activities in Azure.

2. Time Filter: It filters the data to include only activities that have occurred in the last 90 days.

3. Operation Filter: It looks for operations related to LAW tables by checking if the OperationNameValue contains the specific string "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/TABLES/". This string indicates actions performed on LAW tables.

4. Extract Table Name: It creates a new column called TableName by extracting the resource information from the Properties_d field, which likely contains details about the specific table being acted upon.

5. Select and Order Columns: Finally, it selects and orders the columns to display TimeGenerated, TableName, and Caller. This helps in easily identifying when the action took place, which table was affected, and who performed the action.

In summary, this query helps track who has been writing to or deleting from LAW tables over the past 90 days, providing a clear view of these activities for auditing purposes.