Azure Firewall Rule Collection Modified or Deleted

{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/APPLICATIONRULECOLLECTIONS/DELETE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NATRULECOLLECTIONS/DELETE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/WRITE",
      "MICROSOFT.NETWORK/AZUREFIREWALLS/NETWORKRULECOLLECTIONS/DELETE"
    ]
  },
  "condition": "selection"
}

False Positives

• ⚠ Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• ⚠ Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.