PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object

Requête originale, sans modification.

SecurityEvent 
| where EventID == 5136 
   and (EventData matches regex @"(?i)OU=Domain Controllers"
      or EventData matches regex @"(?i)OU=Tier 0 Accounts" 
      or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
      or EventData matches regex @"(?i)OU=Tier 2 Accounts"
      or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
      or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
      or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
      or EventData matches regex @"(?i)OU=Tier 0 PAW"
      or EventData matches regex @"(?i)OU=Tier 1 PAW"
      or EventData matches regex @"(?i)OU=Tier 2 PAW"
      or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
      or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
   and (EventData has 'AttributeValue">512'
      or EventData has 'AttributeLDAPDisplayName">userAccountControl'
      or EventData has 'AttributeLDAPDisplayName">lockoutTime'
      or EventData has 'AttributeLDAPDisplayName">pwdLastSet')
   and (EventData has 'AttributeValue">512'
      or EventData has 'AttributeValue">514'
      or EventData has 'AttributeValue">0'
      or EventData has 'AttributeValue">4130'
      or EventData has 'AttributeValue">4128')
   and EventData has 'OperationType">%%14674'
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(isempty(ObjectTier), 
                    iff(EventData matches regex @"(?i)OU=Domain Controllers", "Tier 0", "Outside Tier Model"), 
                    ObjectTier)
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend AttributeValue = iff(EventData has 'AttributeValue">512' or EventData has 'AttributeValue">4128', "Enabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">514' or EventData has 'AttributeValue">4130', "Disabled", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "pwdLastSet", "Password Reset", tostring(AttributeValue))
| extend AttributeValue = iff(EventData has 'AttributeValue">0' and AttributeLDAP == "lockoutTime", "Account Unlocked", tostring(AttributeValue))
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , ObjectClass
   , AttributeValue    
   , ActivityType
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData