turbot/tailpipe-mod-azure-activity-log-detections

Query: kubernetes_cluster_deleted

Usage

powerpipe query azure_activity_log_detections.query.kubernetes_cluster_deleted

Tailpipe Tables

SQL

select
tp_timestamp as timestamp,
operation_name as operation,
resource_id as resource,
caller as actor,
tp_index::varchar as subscription_id,
resource_group_name as resource_group,
tp_id as source_id,
status as event_status,
*
from
azure_activity_log
where
operation_name = 'Microsoft.Kubernetes/connectedClusters/delete'
and status = 'Succeeded'
order by
timestamp desc;

Detections

The query is being used by the following detections: