KQL Search

Query Details

HomeAI ToolsDevice Query

Azure Function App Stopped Or Deleted

Query

AzureActivity
| where OperationNameValue == "StopWebSite" or OperationName == "DeleteWebSite" or OperationNameValue == "MICROSOFT.WEB/SITES/DELETE"
| where ActivityStatusValue startswith "Succe" or ActivityStatusValue startswith "accept" 
//Azure Activity must be enabled https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics

Explanation

This query is searching through Azure Activity logs to find records of specific operations related to websites. It looks for activities where a website was stopped or deleted. Additionally, it filters these activities to only include those that were successful or accepted.

Details

Jay Kerai profile picture

Jay Kerai

Released: September 5, 2025

Tables

AzureActivity

Keywords

AzureActivityOperationNameActivityStatus

Operators

|where==orstartswith

Actions