Defender XDR Custom Detection Modifications
Query
CloudAppEvents
| where ActionType == @"DeleteCustomDetection" or ActionType == @"CreateCustomDetection" or ActionType == @"EditCustomDetection"Explanation
This query is searching through a dataset called CloudAppEvents to find records where the action taken is either deleting, creating, or editing a custom detection. Essentially, it's filtering the data to show only those specific types of actions related to custom detections.