Forum Discussion

Yashrajsp10's avatar
Yashrajsp10
Copper Contributor
Feb 06, 2023

VMs Deletion

Hi Techies,

 

Our SOC team got an alert where 25 VMs were deleted in a single session. The investigation logs in 365 Defender show that the VMs were successfully deleted the same was confirmed with the user who deleted those VMs.

But I still see those VMs as resources in the subscription. They are still there.

What could be the reason? Probably that it was not deleted properly. Please help. 

 

Thanks 🙂

 

Alerts
Investigation
SIEM
  • Robina's avatar
    Robina
    Feb 06, 2023
    There could be a delay in the updates being reflected in the subscription view, due to caching or synchronization issues.You should check the status of the deletion process, validate if the VMs are still attached to a resource group, and force a synchronization or clear cache if necessary. It is also advisable to run a script to check the consistency of resources in the subscription.
  • Robina's avatar
    Robina
    Iron Contributor
    Feb 06, 2023
    There could be a delay in the updates being reflected in the subscription view, due to caching or synchronization issues.You should check the status of the deletion process, validate if the VMs are still attached to a resource group, and force a synchronization or clear cache if necessary. It is also advisable to run a script to check the consistency of resources in the subscription.

Share

Resources