Forum Discussion
Microsoft Sentinel Deployment & Log Ingestion: Ingesting Platform Logs via Diagnostic Settings
Hello Immersive Labs community, I’ve been working through the lab tasks and successfully completed tasks 1 through 6. However, I’m stuck on task 7, which asks: "A storage account has been deleted. ...
SamDickison
Community Manager
Community ManagerThe two hints I managed to find, whether they helpful or not...
1. Start by filtering for the specific operation: AzureActivity | where OperationNameValue has "delete"
2. Remember that platform logs regarding the lifecycle of a resource are categorized differently than logs regarding the usage of that resource.
Any help?
