PROD (TM001.1) - GROUP - Added to Group Outside the Object Tier Level

Requête originale, sans modification.

SecurityEvent 
| where EventID == 5136
    and Activity has "modified"
    and (EventData matches regex @"(?i)OU=Tier 0 Accounts" 
         or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
         or EventData matches regex @"(?i)OU=Tier 2 Accounts"
         or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
         or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
         or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
         or EventData matches regex @"(?i)OU=Tier 0 Groups"
         or EventData matches regex @"(?i)OU=Tier 1 Groups"
         or EventData matches regex @"(?i)OU=Tier 2 Groups"
         or EventData matches regex @"(?i)OU=Tier 0 PAW"
         or EventData matches regex @"(?i)OU=Tier 1 PAW"
         or EventData matches regex @"(?i)OU=Tier 2 PAW")
    and EventData has '"AttributeLDAPDisplayName">member'
    and EventData has 'OperationType">%%14674'
| extend GroupName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend GroupName = extract("(?i)CN=([^,]+)", 1, GroupName_e)
| where GroupName != "Protected Users"
| where GroupName != "Allowed RODC Password Replication Group"
| extend GroupTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend GroupTier = extract("(?i)OU=(Tier [^ ]+)", 1, GroupTier_e)
| extend GroupTier = iff(isempty(GroupTier), "Outside Tier Model", GroupTier)
| extend ObjectName_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"AttributeValue\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(isempty(ObjectTier), "Outside Tier Model", ObjectTier)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| where GroupTier != ObjectTier
| project TimeGenerated 
        , ObjectName
        , ObjectTier
        , ObjectType = AccountType
        , GroupName
        , GroupTier
        , ActivityType
        , OperationType
        , Account
        , Domain
        , Computer
        , Channel
        , EventID
        , EventData