Monitoring/KQL to see who deleted CFS/readme.me