PROD (TM002.1) - OBJECT - Created or Deleted a Tier Level Object

Requête originale, sans modification.

SecurityEvent 
| where (EventID == 5137
    or EventID == 5141)
    and (EventData matches regex @"(?i)OU=Domain Controllers"
        or EventData matches regex @"(?i)OU=Tier 0 Accounts" 
        or EventData matches regex @"(?i)OU=Tier 1 Accounts" 
        or EventData matches regex @"(?i)OU=Tier 2 Accounts"
        or EventData matches regex @"(?i)OU=Tier 0 Service Accounts" 
        or EventData matches regex @"(?i)OU=Tier 1 Service Accounts" 
        or EventData matches regex @"(?i)OU=Tier 2 Service Accounts"
        or EventData matches regex @"(?i)OU=Tier 0 Groups"
        or EventData matches regex @"(?i)OU=Tier 1 Groups"
        or EventData matches regex @"(?i)OU=Tier 2 Groups"
        or EventData matches regex @"(?i)OU=Tier 0 PAW"
        or EventData matches regex @"(?i)OU=Tier 1 PAW"
        or EventData matches regex @"(?i)OU=Tier 2 PAW"
        or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 1 Member Servers"
        or EventData matches regex @"(?i)CN=Builtin"
        or EventData matches regex @"(?i)CN=Computers"
        or EventData matches regex @"(?i)CN=Users")
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectTier = extract("(?i)OU=(Tier [^ ,]+)", 1, ObjectTier_e)
| extend ObjectTier = iff(ObjectTier == "", "Outside Tier Model", ObjectTier)
| extend ObjectTier = iff(ObjectTier_e has "OU=Domain Controllers", "Tier 0", ObjectTier)
| extend ObjectClass = extract("<Data Name=\"ObjectClass\">([^<]+)</Data>", 1, EventData)
| where ObjectClass !has "organizationalUnit" and ObjectClass !has "msFVE-RecoveryInformation"
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend SubjectUserName = extract("<Data Name=\"SubjectUserName\">([^<]+)</Data>", 1, EventData)
| extend SubjectDomainName = extract("<Data Name=\"SubjectDomainName\">([^<]+)</Data>", 1, EventData)
| extend Account = strcat(SubjectDomainName, "\\", SubjectUserName)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| project TimeGenerated
        , ObjectName
        , ObjectTier
        , ObjectClass
        , ActivityType
        , Account
        , Domain
        , Computer
        , Channel
        , EventID
        , EventData