PROD (TM013.1) - OU - Block Inheritance was Enabled on an OU

Requête originale, sans modification.

SecurityEvent
| where EventID == 5136
    and Activity has "modified"
    and EventData has '"ObjectClass">organizationalUnit'
    and EventData has '<Data Name="AttributeLDAPDisplayName">gPOptions</Data>'
| extend ObjectName = extract("<Data Name=\"ObjectDN\">((?i)OU=[^,]+(,(?i)OU=[^,]+)*),(?i)DC=", 1, EventData)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([0-9]+)</Data>", 1, EventData)
| extend ActivityType = case(
    AttributeValue == "1", "Block Inheritance Enabled",
    AttributeValue == "0", "Block Inheritance Disabled",
    "Block Inheritance Modified")
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
    , ObjectName
    , ObjectClass
    , ActivityType
    , AttributeLDAP
    , Account
    , Domain
    , Computer
    , Channel
    , EventID
    , EventData