Who Deleted Alert Rule
Query
AzureActivity
| where OperationName == "Delete Alert Rules" and ActivityStatusValue == "Succeeded"
| project Caller , EventSubmissionTimestampExplanation
This query is searching in the AzureActivity table for events where the operation name is "Delete Alert Rules" and the activity status is "Succeeded". It then selects the Caller and EventSubmissionTimestamp columns from the results.
Details
Rod Trent
Released: March 26, 2020
Tables
AzureActivity
Keywords
AzureActivityOperationNameDelete Alert RulesActivityStatusValueSucceededCallerEventSubmissionTimestamp
Operators
==andproject