Forum Discussion
KQL query to detect the disablement and deletion of Automation Rules
Hi Community, We want to create a KQL-query that detects whether an automation rule has been disabled. The only way to partially do that at the moment is the AzureActivity table. The problem with...
Hi LeonPavesic ,
Unfortunatelly the AzureActivity Table does not contain the OperationName and Action table, so this does not work.
Unfortunatelly the AzureActivity Table does not contain the OperationName and Action table, so this does not work.
That is the legacy Column name, which is now deprecated - its a shame as that did provide the data, before we migrated away.
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#data-structure-changes
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#legacy-collection-methods
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#data-structure-changes
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#legacy-collection-methods
- Hi Clive_Watson ,
thanks for letting us know, it is indeed a shame that Microsoft makes something deprecated and at the same time making it worse. I hope they will release an updated table in the future.