Who Deleted Alert Rule
Query
AzureActivity
| where OperationName == "Delete Alert Rules" and ActivityStatusValue == "Succeeded"
| project Caller , EventSubmissionTimestampExplanation
This query is searching in the AzureActivity table for events where the operation name is "Delete Alert Rules" and the activity status is "Succeeded". It then selects the Caller and EventSubmissionTimestamp columns from the results.