Alerts on specific commands applied to Mariadb using log analytics

laurakate_young 

I would have thought there would be one column that was unique to MariaDB, like there is for SQL - with ResourceProvider.  Anyway moving on...

Anyway you may want to assign a count to AggregatedValue 

AzureDiagnostics
| where Resource == "CONTOSOSQL1NSG"
| where sql_text_s contains "drop" or sql_text_s contains "delete"
| summarize AggregatedValue  = count() by bin(TimeGenerated, 5m)

or just

AzureDiagnostics
| where Resource == "CONTOSOSQL1NSG"
| where sql_text_s contains "drop" or sql_text_s contains "delete"
| summarize AggregatedValue  = count() 

There a great series of post on Alerts https://cloudadministrator.net/2019/08/15/azure-monitor-alerts-series-part-1/  especially part 7 : https://cloudadministrator.net/2019/10/07/azure-monitor-alert-series-part-7/