azurednsazure-dns

How to query for deleted DNS A record in Azure

I would like to setup an alert for when a DNS A record gets deleted within a DNS zone.

Let us assume the private DNS zone is called, privatelink.xx.arc.azure.com, is there a way to write a KQL/resource graph query which can then be used as part of an alert, either for when an A record is deleted or perhaps if any record is deleted from the zone.

Thanks in advance.

Solution

  • How to query for deleted DNS A record in Azure

    Here is the KQL query to check the deleted records in private DNS Zone.

    enter image description here

    Note: If the Activity Logs table is not showing, make sure to export the settings to a Log Analytics Workspace by navigating to Private DNS Zone > Activity Log > Export Activity Logs > Diagnostic Settings. Then, wait for some time to allow the logs to sync with the workspace."

    enter image description here

    Select New alert rule and configure the alert configuration details.

    enter image description here

    You will receive an alert after you delete the A record in the Private DNS Zone as shown below.

    enter image description here

    Follow the Stack Link for more details