Dataverse - Audit log data deletion

let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
| extend CloudAppId = int(32780)
| extend AccountName = tostring(split(UserId, "@")[0])
| extend UPNSuffix = tostring(split(UserId, "@")[1])
| project
    TimeGenerated,
    UserId,
    ClientIp,
    UserAgent,
    Message,
    EntityName,
    InstanceUrl,
    AccountName,
    UPNSuffix,
    CloudAppId

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: UPNSuffix
    columnName: UPNSuffix
- entityType: CloudApplication
  fieldMappings:
  - identifier: AppId
    columnName: CloudAppId
  - identifier: InstanceName
    columnName: InstanceUrl
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: ClientIp
tactics:
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - DataverseActivity
  connectorId: Dataverse
alertDetailsOverride:
  alertDisplayNameFormat: Dataverse - Audit logs deleted in {{InstanceUrl}}
  alertDescriptionFormat: User {{UserId}} deleted audit log data in {{InstanceUrl}}. The message type is  {{Message}}.
id: f1634822-b7e9-44f5-95ac-fa4a04f14513
severity: Low
eventGroupingSettings:
  aggregationKind: SingleAlert
status: Available
query: |
  let query_frequency = 1h;
  DataverseActivity
  | where TimeGenerated >= ago(query_frequency)
  | where Message =~ 'DeleteRecordChangeHistory' or Message =~ 'DeleteAuditData'
  | extend CloudAppId = int(32780)
  | extend AccountName = tostring(split(UserId, "@")[0])
  | extend UPNSuffix = tostring(split(UserId, "@")[1])
  | project
      TimeGenerated,
      UserId,
      ClientIp,
      UserAgent,
      Message,
      EntityName,
      InstanceUrl,
      AccountName,
      UPNSuffix,
      CloudAppId  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft Business Applications/Analytic Rules/Dataverse - Audit log data deletion.yaml
kind: Scheduled
queryPeriod: 14d
version: 3.2.0
name: Dataverse - Audit log data deletion
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1070
description: Identifies audit log data deletion activity in Dataverse.
triggerOperator: gt