Lookout - Critical Audit and Policy Changes (v2)

Original query, unchanged.

LookoutEvents
| where EventType == "AUDIT"
| where AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE", "USER_MANAGEMENT", "CONFIGURATION_CHANGE")
| extend 
    ChangeImpact = case(
        AuditType == "POLICY_CHANGE", "High",
        AuditType == "SECURITY_SETTING_CHANGE", "High",
        AuditType == "USER_MANAGEMENT", "Medium",
        AuditType == "CONFIGURATION_CHANGE", "Medium",
        "Low"
    ),
    RiskLevel = case(
        ActorType == "SYSTEM" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Automated Change",
        ActorType == "ADMIN_USER" and AuditType == "POLICY_CHANGE", "Administrative Change",
        ActorType == "USER" and AuditType in ("POLICY_CHANGE", "SECURITY_SETTING_CHANGE"), "Unauthorized Change",
        ActorType == "UNKNOWN", "Suspicious Change",
        "Standard Change"
    )
| extend SecurityImplications = case(
    AuditAttributeChanges has "threat_response_level" and AuditAttributeChanges has "LOW", "Threat Response Weakened",
    AuditAttributeChanges has "auto_quarantine_enabled" and AuditAttributeChanges has "false", "Auto-Quarantine Disabled",
    AuditAttributeChanges has "compliance_enforcement" and AuditAttributeChanges has "false", "Compliance Enforcement Disabled",
    AuditAttributeChanges has "device_wipe_enabled" and AuditAttributeChanges has "false", "Device Wipe Disabled",
    AuditAttributeChanges has "admin" or AuditAttributeChanges has "privilege", "Privilege Changes",
    "Configuration Update"
)
| extend ComplianceRisk = case(
    SecurityImplications in ("Threat Response Weakened", "Auto-Quarantine Disabled", "Compliance Enforcement Disabled"), "Critical",
    SecurityImplications == "Device Wipe Disabled", "High",
    SecurityImplications == "Privilege Changes", "High",
    RiskLevel == "Unauthorized Change", "High",
    RiskLevel == "Suspicious Change", "Medium",
    "Low"
)
| extend ChangeDetails = case(
    isnotempty(AuditAttributeChanges), strcat("Attribute changes: ", tostring(AuditAttributeChanges)),
    isnotempty(TargetGuid), strcat("Target: ", TargetType, " (", TargetGuid, ")"),
    "General audit event"
)
| project
    TimeGenerated,
    EventId,
    AuditType,
    ChangeImpact,
    RiskLevel,
    SecurityImplications,
    ComplianceRisk,
    ChangeDetails,
    AuditAttributeChanges,
    ActorType,
    ActorGuid,
    TargetType,
    TargetGuid,
    TargetEmailAddress,
    ChangeType,
    EnterpriseGuid