Tailscale: OAuth client or API key created with write scopes

Requête originale, sans modification.

Tailscale_Audit_CL
| where EventType == "CONFIG"
| where Action == "CREATE"
| where tostring(Target.type) in ("API_KEY", "OAUTH_CLIENT")
| extend Scopes = extract(@"scopes\s*-\s*(.+)$", 1, ActionDetails)
| where Scopes contains ":write"
| extend WriteScopes = extract_all(@"([a-zA-Z_]+:write)", Scopes)
| extend ActorLogin = tostring(Actor.loginName)
| extend ActorType = tostring(Actor.type)
| extend TargetName = tostring(Target.name)
| extend TargetId = tostring(Target.id)
| extend TargetType = tostring(Target.type)
| project TimeGenerated, ActorLogin, ActorType, Action, TargetType, TargetName, TargetId, WriteScopes, Scopes, Origin, ActionDetails