Dataverse - Audit log data deletion

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
| extend CloudAppId = int(32780)
| extend AccountName = tostring(split(UserId, "@")[0])
| extend UPNSuffix = tostring(split(UserId, "@")[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    UserAgent,
    Message,
    EntityName,
    InstanceUrl,
    AccountName,
    UPNSuffix,
    CloudAppId

kind: Scheduled
version: 3.2.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit log data deletion.yaml
triggerThreshold: 0
relevantTechniques:
- T1070
tactics:
- DefenseEvasion
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: UPNSuffix
    identifier: UPNSuffix
- entityType: CloudApplication
  fieldMappings:
  - columnName: CloudAppId
    identifier: AppId
  - columnName: InstanceUrl
    identifier: InstanceName
- entityType: IP
  fieldMappings:
  - columnName: ClientIp
    identifier: Address
eventGroupingSettings:
  aggregationKind: SingleAlert
queryFrequency: 1h
name: Dataverse - Audit log data deletion
description: Identifies audit log data deletion activity in Dataverse.
alertDetailsOverride:
  alertDescriptionFormat: User {{UserId}} deleted audit log data in {{InstanceUrl}}. The message type is  {{Message}}.
  alertDisplayNameFormat: Dataverse - Audit logs deleted in {{InstanceUrl}}
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
  | extend CloudAppId = int(32780)
  | extend AccountName = tostring(split(UserId, "@")[0])
  | extend UPNSuffix = tostring(split(UserId, "@")[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      UserAgent,
      Message,
      EntityName,
      InstanceUrl,
      AccountName,
      UPNSuffix,
      CloudAppId  
queryPeriod: 14d
triggerOperator: gt
id: f1634822-b7e9-44f5-95ac-fa4a04f14513
status: Available
severity: Low
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse