SAP BTP - User added to sensitive privileged role collection

Requête originale, sans modification.

let monitored_rolecollections = dynamic(["Subaccount Service Administrator", "Subaccount Administrator", "Connectivity and Destination Administrator", "Destination Administrator", "Cloud Connector Administrator"]);
SAPBTPAuditLog_CL
| where Message.object has "xs_rolecollection2user"
| extend ObjectId = parse_json((Message.object).id)
| where ObjectId.crudType == "CREATE"
| extend RoleCollection = ObjectId.rolecollection_name, TargetUserId = ObjectId.user_id
| where RoleCollection in (monitored_rolecollections)
| project UpdatedOn, UserName, RoleCollection, TargetUserId, Tenant, SpaceId, CloudApp = "SAP BTP"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]