Find write queries

An auditor requested, if some specific users ever did any write statements to a production database. Log analytics to the rescue :)

//Find queries by users in the list, that did INSERT, UPDATE, DELETE, ALTER, CREATE and DROP

AzureDiagnostics
| where Category == "SQLSecurityAuditEvents"
| where action_name_s in ("BATCH COMPLETED")
| where server_principal_name_s in ("usr@domain.tld")
| where statement_s matches regex @"INSERT|UPDATE|DELETE|ALTER|CREATE|DROP"
| project
    TimeGenerated,
    User = server_principal_name_s,
    Action = action_name_s,
    Database = database_name_s,
    Statement = statement_s,
    ClientIP = client_ip_s,
    ApplicationName = application_name_s,
    Succeeded = succeeded_s
| order by TimeGenerated desc