AuditLogs
| where TimeGenerated > ago(1d)
| where OperationName startswith "Delete"
| extend Actor = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName))
| extend Resource = tostring(TargetResources[0].displayName)
| summarize DeletionCount = count(), Resources = make_set(Resource, 20), Operations = make_set(OperationName) by Actor, bin(TimeGenerated, 1h)
| where DeletionCount >= 10
| sort by DeletionCount desc