turbot/tailpipe-mod-azure-activity-log-detections

Detection: Storage Account Deleted

Overview

Detect when an Azure Storage account was deleted. Deleting a storage account can result in the loss of critical data, disrupt applications, and affect dependent services. Monitoring these deletions ensures data availability, operational continuity, and protection against unauthorized or accidental deletions.

References:

Usage

Run the detection in your terminal:

powerpipe detection run azure_activity_log_detections.detection.storage_account_deleted

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run azure_activity_log_detections.detection.storage_account_deleted --share

SQL

This detection uses a named query:

select
tp_timestamp as timestamp,
operation_name as operation,
resource_id as resource,
caller as actor,
tp_index::varchar as subscription_id,
resource_group_name as resource_group,
tp_id as source_id,
status as event_status,
*
from
azure_activity_log
where
operation_name = 'Microsoft.Storage/storageAccounts/delete'
and status = 'Succeeded'
order by
timestamp desc;

Tags