F&O - Non-interactive account mapped to self or sensitive privileged user

Requête originale, sans modification.

// Add sensitive privilege accounts to the privileged_user_accounts variable.
// Example: let privileged_user_accounts = dynamic(["Admin1", "Admin"]);
let privileged_user_accounts = dynamic([]);
FinanceOperationsActivity_CL
| where TableName == "SysAADClientTable" and LogType in ("Insert", "Update")
| extend ClientId = tostring(parse_json(tostring(FormattedData.["03::AADClientId"])).NewData)
| extend User = parse_json(tostring(FormattedData.UserId))
| extend
    MappedUser = tostring(User.NewData),
    PreviousUserId = tostring(User.OldData),
    TargetAppName = tostring(parse_json(tostring(FormattedData.Name)).NewData),
    FinOpsAppId = 32780
| where MappedUser in (privileged_user_accounts) or LogCreatedBy == MappedUser
| project
    LogCreatedDateTime,
    LogCreatedBy,
    LogType,
    TargetAppName,
    MappedUser,
    PreviousUserId,
    ClientId,
    FinOpsAppId