Modifications To Azure DNS Zones
Query
//Ensure you have read-only Resource Locks for critical DNS Zones and Azure Policy deny delete actions on all critical zones
AzureActivity
| where OperationNameValue == "privateDnsZones" or OperationNameValue == "dnszones" //all modifications to DNS resources - you can drill down on recordsets or records e.g. dnszones/TXT.
//This query will also catch AVS privatecloud dnzones, getPrivateDnsZoneSuffix for DBfor SQL and privatednszonelinks and privateendpoints dns zones and linksExplanation
This query is designed to monitor changes to DNS resources in Azure. It specifically looks for operations related to "privateDnsZones" and "dnszones," which include any modifications to DNS zones. This can also include more specific elements like record sets or individual records within those zones. Additionally, the query captures activities related to Azure VMware Solution (AVS) private cloud DNS zones, private DNS zone suffixes for SQL databases, and links or endpoints associated with private DNS zones. The goal is to ensure that critical DNS zones have read-only locks and that Azure Policy is set to deny any delete actions on these critical zones.