SAP BTP - Cloud Integration tampering with security material

Original query, unchanged.

let securityMaterialTypes = dynamic(["Credential", "X.509 Certificate", "X.509 Key-Pair", "PGP Public Keys", "PGP Secret Keys"]);
let keystoreActions = dynamic(["Create", "Update", "Change", "Delete"]);
SAPBTPAuditLog_CL
| where Category == "audit.security-events"
| extend data_s = tostring(Message.data),
         ipAddress = tostring(Message.ip)
| extend parsedData = parse_json(data_s)
| extend action = tostring(parsedData.action),
         objectType = tostring(parsedData.objectType),
         objectId = tostring(parsedData.objectId),
         keystoreName = tostring(parsedData.attributes["Keystore Name"])
| where objectType in (securityMaterialTypes)
| where 
    (objectType == "Credential" and action in ("PasswordStore", "PasswordUpdate", "PasswordDelete"))
    or 
    (objectType != "Credential" and action in (keystoreActions))
| extend normalizedAction = case(
    action == "PasswordStore", "created",
    action == "PasswordUpdate", "updated",
    action == "PasswordDelete", "deleted",
    action == "Create", "created",
    action == "Update", "updated",
    action == "Change", "changed",
    action == "Delete", "deleted",
    action
)
| extend MessageText = case(
    objectType == "Credential", strcat("Security credential '", objectId, "' was ", normalizedAction),
    isnotempty(keystoreName), strcat(objectType, " '", objectId, "' was ", normalizedAction, " in keystore '", keystoreName, "'"),
    strcat(objectType, " '", objectId, "' was ", normalizedAction)
)
| project
    UpdatedOn,
    UserName,
    MessageText,
    ObjectType = objectType,
    ObjectId = objectId,
    Action = action,
    NormalizedAction = normalizedAction,
    KeystoreName = keystoreName,
    Tenant,
    ipAddress,
    CloudApp = "SAP Cloud Integration"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]