Detecting Changes in Azure Data Factory Triggers with KQL Queries

 To detect changes in Azure Data Factory (ADF) triggers using Kusto Query Language (KQL), you can use the AzureActivity table in Log Analytics. You can use the following KQL query to identify trigger changes:

AzureActivity | where Category == "DataFactoryPipelineRun" | where OperationName == "Microsoft.DataFactory/factories/pipelines/create" | where ResourceProvider == "MICROSOFT.DATAFACTORY" | where ActivityStatusValue == "Succeeded" | where Details contains "New-AzDataFactoryPipeline"

This query looks for successful pipeline creation operations in ADF and specifically checks if the New-AzDataFactoryPipeline command was used, indicating a new pipeline was created. You can adjust the query to filter for specific triggers or time ranges by adding additional where clauses.

Note that if ADF auditing is not enabled, or if the logs are not sent to Log Analytics, the AzureActivity table may not contain the necessary information.