// Query 3: Soft Delete Operations (Ransomware Indicator)
// Pattern B - Ransomware Resilience Pattern
// Purpose: Alert on any soft delete operations which could indicate ransomware or accidental deletion
// Frequency: Real-time alert (trigger on any match)

AzureDiagnostics
| where ResourceType == "VAULTS"
| where OperationName in ("SoftDelete", "DeleteRecoveryPoint", "UndeleteRecoveryPoint")
| project 
    TimeGenerated, 
    CallerIPAddress = tostring(parse_json(Identity)["callerIPAddress"]),
    Caller = tostring(parse_json(Identity)["caller"]),
    ResourceName,
    OperationName,
    BackupItemFriendlyName,
    Status,
    Details = tostring(parse_json(Details))
| order by TimeGenerated desc