Dataverse - Audit log data deletion

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
| extend CloudAppId = int(32780)
| extend AccountName = tostring(split(UserId, "@")[0])
| extend UPNSuffix = tostring(split(UserId, "@")[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    UserAgent,
    Message,
    EntityName,
    InstanceUrl,
    AccountName,
    UPNSuffix,
    CloudAppId

kind: Scheduled
requiredDataConnectors:
- connectorId: Dataverse
  dataTypes:
  - DataverseActivity
relevantTechniques:
- T1070
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ClientIp
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
  | extend CloudAppId = int(32780)
  | extend AccountName = tostring(split(UserId, "@")[0])
  | extend UPNSuffix = tostring(split(UserId, "@")[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      UserAgent,
      Message,
      EntityName,
      InstanceUrl,
      AccountName,
      UPNSuffix,
      CloudAppId  
triggerThreshold: 0
alertDetailsOverride:
  alertDisplayNameFormat: Dataverse - Audit logs deleted in {{InstanceUrl}}
  alertDescriptionFormat: User {{UserId}} deleted audit log data in {{InstanceUrl}}. The message type is  {{Message}}.
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit log data deletion.yaml
queryPeriod: 14d
tactics:
- DefenseEvasion
name: Dataverse - Audit log data deletion
status: Available
eventGroupingSettings:
  aggregationKind: SingleAlert
description: Identifies audit log data deletion activity in Dataverse.
id: f1634822-b7e9-44f5-95ac-fa4a04f14513
version: 3.2.0
triggerOperator: gt
queryFrequency: 1h
severity: Low