❌

Normal view

There are new articles available, click to refresh the page.
Before yesterdayMain stream

How to see in KQL if someone disabled or deleted an Automation?

I can only see automation rules being triggered (success or failure). I want to create a rule to detect if someone disabled or deleted an automation

query I tried:
SentinelHealth
| where SentinelResourceType in ("Playbook", "Automation rule")

submitted by /u/FiniteStateAutomata
[link] [comments]
❌
❌