How to see in KQL if someone disabled or deleted an Automation?
12 October 2025 at 23:03
I can only see automation rules being triggered (success or failure). I want to create a rule to detect if someone disabled or deleted an automation
query I tried:
SentinelHealth
| where SentinelResourceType in ("Playbook", "Automation rule")
[link] [comments]