May 27 2020 03:19 AM
Is there an audit trail for us to track incident management, creation/editing/deletion of rules and such on Azure Sentinel?
May 27 2020 03:46 AM
@S7RAY This capability exists somewhat in the AzureActivity data. Here's an example for an alert being deleted:
AzureActivity
| where OperationName == "Delete Alert Rules" and ActivityStatusValue == "Succeeded"
| project Caller , EventSubmissionTimestamp
This will be better exposed in the near future.