Query Details

Watchlist Item Delete

Query

// Identifies when an item was deleted from any Watchlist

Watchlist
| where _DTItemStatus == "Delete"

Explanation

This query looks for when an item was deleted from any Watchlist by filtering for items with a status of "Delete".