EXPLORE
Sign In
← Back to Explore
kqlHunting

Azure Log Analytic Table Operation Audit

For auditing Write/Delete actions upon LAW Tables

Detection Query

//For auditing Write/Delete actions upon LAW Tables
AzureActivity
| where TimeGenerated > ago(90d)
| where OperationNameValue contains "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/TABLES/"
| extend TableName = Properties_d.resource
| project-reorder TimeGenerated, TableName, Caller

Data Sources

AzureActivity

Tags

azure
Raw Content
//For auditing Write/Delete actions upon LAW Tables
AzureActivity
| where TimeGenerated > ago(90d)
| where OperationNameValue contains "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/TABLES/"
| extend TableName = Properties_d.resource
| project-reorder TimeGenerated, TableName, Caller