SAP BTP - Cloud Identity Service application configuration monitor

Original query, unchanged.

SAPBTPAuditLog_CL
| extend data_s = tostring(Message.data)
| extend 
    action = extract(@"action=""([^""]+)""", 1, data_s),
    state = extract(@"state=""([^""]+)""", 1, data_s),
    objectType = extract(@"objectType=""([^""]+)""", 1, data_s),
    serviceProviderName = extract(@"serviceProviderName=""([^""]+)""", 1, data_s),
    ipAddress = extract(@"ipAddress=""([^""]+)""", 1, data_s),
    // Extract payload JSON for federation type
    payloadJson = extract(@"\{""payload"":\{([^}]+)\}\}", 1, data_s)
| extend federationType = extract(@"""type"":""([^""]+)""", 1, payloadJson)
| where objectType == "ssoDomain"
| where state == "successful"
| where action in ("create", "update", "delete")
| extend MessageText = case(
    action == "create", strcat("Application '", serviceProviderName, "' (", federationType, ") was created"),
    action == "update", strcat("Application '", serviceProviderName, "' (", federationType, ") was updated"),
    action == "delete", strcat("Application '", serviceProviderName, "' was deleted"),
    "Unclassified operation on application"
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ServiceProviderName = serviceProviderName,
    FederationType = federationType,
    Action = action,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Identity Service"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]