activity_dashboard_logs_by_actoractivity_dashboard_logs_by_eventactivity_dashboard_logs_by_resource_groupactivity_dashboard_logs_by_serviceactivity_dashboard_logs_by_source_ipactivity_dashboard_logs_by_subscriptionactivity_dashboard_total_logsautomation_account_runbook_deletedcompute_disk_deletedcompute_snapshot_deletedcompute_vm_role_assignment_created_or_updatedcontainer_registry_deletedevent_hub_namespace_deletedevent_hub_namespace_rule_authorizedfront_door_firewall_policy_deletediam_role_assignment_created_or_updatedkey_vault_access_policy_created_or_updatedkey_vault_deletedkubernetes_cluster_deletedmonitor_diagnostic_setting_deletednetwork_application_gateway_deletednetwork_application_security_group_deletednetwork_dns_zone_deletednetwork_firewall_deletednetwork_firewall_policy_deletednetwork_firewall_rule_created_or_updatednetwork_firewall_rule_deletednetwork_security_group_created_or_updatednetwork_security_group_deletednetwork_virtual_network_created_or_updatednetwork_virtual_network_deletednetwork_vpn_connection_created_or_updatednetwork_vpn_connection_deletednetwork_watcher_deletedresource_group_deletedsql_database_deletedsql_database_tde_created_or_updatedsql_server_deletedsql_server_firewall_rule_created_or_updatedsql_server_role_assignment_created_or_updatedstorage_account_deletedstorage_account_key_regeneratedstorage_account_lifecycle_policy_updated
Query: network_dns_zone_deleted
Usage
powerpipe query azure_activity_log_detections.query.network_dns_zone_deleted
Tailpipe Tables
SQL
select tp_timestamp as timestamp,operation_name as operation,resource_id as resource,caller as actor,tp_index::varchar as subscription_id,resource_group_name as resource_group,tp_id as source_id,status as event_status,*
from azure_activity_logwhere operation_name = 'Microsoft.Network/dnsZones/delete' and status = 'Succeeded'
order by timestamp desc;
Detections
The query is being used by the following detections: