On a Linux device, a file was silently removed from the /tmp/victim-files directory. Search through file event or syslog records to identify the exact file name that was deleted.

let targetFolder = "/tmp/victim-files";
union DeviceFileEvents, DeviceEvents, DeviceProcessEvents
| extend AF = tostring(AdditionalFields),
         PC = tostring(ProcessCommandLine),
         IPC = tostring(InitiatingProcessCommandLine),
         FN = tostring(FileName),
         FP = tostring(FolderPath),
         AT = tolower(tostring(ActionType))
// Narrow to records that reference the target folder/path anywhere in common text fields
| where FP startswith targetFolder
      or FN startswith strcat(targetFolder, "/")
      or FN contains targetFolder
      or AF contains targetFolder
      or PC contains targetFolder
      or IPC contains targetFolder
// And that include deletion indicators in ActionType, command lines or additional fields
| where AT contains "delete" or AT contains "del" or AT contains "unlink" or AT contains "remove" or AT contains "rm"
      or tolower(AF) contains "unlink" or tolower(AF) contains "rm" or tolower(AF) contains "remove" or tolower(AF) contains "deleted" or tolower(AF) contains "delete"
      or tolower(PC) contains "unlink" or tolower(PC) contains "rm" or tolower(PC) contains "remove" or tolower(PC) contains "deleted" or tolower(PC) contains "delete"
      or tolower(IPC) contains "unlink" or tolower(IPC) contains "rm" or tolower(IPC) contains "remove" or tolower(IPC) contains "deleted" or tolower(IPC) contains "delete"
// Normalize a FullPath for easier grouping
| extend FullPath = case(
        FN contains "/", FN,
        isnull(FP) or FP == "", FN,
        FP endswith "/", strcat(FP, FN), strcat(FP, "/", FN)
    )
// Return the most recent evidence per file path + device
| summarize arg_max(TimeGenerated, *) by tostring(FullPath), DeviceId
| project TimeGenerated, DeviceName, DeviceId, FullPath, FileName = FN, FileSize, ActionType = AT, SourceType = Type, InitiatingProcessFileName, InitiatingProcessCommandLine = IPC, ProcessCommandLine = PC, AdditionalFields = AF
| order by TimeGenerated desc
| take 200

let LinuxDevices = DeviceInfo
| where OSPlatform == "Linux"
| distinct DeviceId;
LinuxDevices
| join kind=inner (
    union isfuzzy=true DeviceFileEvents, DeviceEvents, DeviceProcessEvents
    | where FolderPath has "/tmp/victim-files" or FileName has "/tmp/victim-files" or AdditionalFields has "/tmp/victim-files" or ProcessCommandLine has "/tmp/victim-files"
    | where ActionType in ("FileDeleted", "FileRemove", "FileRemoved", "FileRenamed")
        or AdditionalFields has_any ("delete", "removed", "unlink")
        or (ProcessCommandLine has_any ("rm", "unlink"))
    | project TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, ActionType, AdditionalFields, ProcessCommandLine
) on DeviceId
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, AdditionalFields, ProcessCommandLine
| order by TimeGenerated desc

union DeviceFileEvents, DeviceProcessEvents, DeviceEvents
| join kind=inner (
    DeviceInfo
    | where OSPlatform =~ "Linux"
) on DeviceId
| where FolderPath startswith "/tmp/victim-files"
  or AdditionalFields contains "/tmp/victim-files"
  or InitiatingProcessCommandLine contains "/tmp/victim-files"
| where ActionType in ("FileDeleted", "FileRemoved", "FileDelete")
  or AdditionalFields has_any ("delete", "removed")
  or InitiatingProcessCommandLine has "rm "
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, AdditionalFields, InitiatingProcessCommandLine
| order by TimeGenerated desc