Queries for the PurviewSecurityLogs table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Audit collection delete events

Display audit logs for collection delete events.

PurviewSecurityLogs
| where EntityType == 'Collections'
| where OperationName == 'Delete'
| take 100