Queries in Azure Activity Log Detections

The Azure Activity Log Detections mod includes 43 queries:

• activity_dashboard_logs_by_actor
• activity_dashboard_logs_by_event
• activity_dashboard_logs_by_resource_group
• activity_dashboard_logs_by_service
• activity_dashboard_logs_by_source_ip
• activity_dashboard_logs_by_subscription
• activity_dashboard_total_logs
• automation_account_runbook_deleted
• compute_disk_deleted
• compute_snapshot_deleted
• compute_vm_role_assignment_created_or_updated
• container_registry_deleted
• event_hub_namespace_deleted
• event_hub_namespace_rule_authorized
• front_door_firewall_policy_deleted
• iam_role_assignment_created_or_updated
• key_vault_access_policy_created_or_updated
• key_vault_deleted
• kubernetes_cluster_deleted
• monitor_diagnostic_setting_deleted
• network_application_gateway_deleted
• network_application_security_group_deleted
• network_dns_zone_deleted
• network_firewall_deleted
• network_firewall_policy_deleted
• network_firewall_rule_created_or_updated
• network_firewall_rule_deleted
• network_security_group_created_or_updated
• network_security_group_deleted
• network_virtual_network_created_or_updated
• network_virtual_network_deleted
• network_vpn_connection_created_or_updated
• network_vpn_connection_deleted
• network_watcher_deleted
• resource_group_deleted
• sql_database_deleted
• sql_database_tde_created_or_updated
• sql_server_deleted
• sql_server_firewall_rule_created_or_updated
• sql_server_role_assignment_created_or_updated
• storage_account_deleted
• storage_account_key_regenerated
• storage_account_lifecycle_policy_updated