GitLab - External User Added to GitLab

Original query, unchanged.

// List of allow-listed domains
let allowedDomain = pack_array("mydomain.com");
GitLabAudit
| where AddAction == "user"
| project AuthorName, IPAddress, User = EntityName
| join (GitLabApp 
| where UserAdded == 1
| parse kind=regex Message with "User \"" User "\"" EmailAddress " was created"
| project tostring(User), EmailAddress = substring(EmailAddress,2,strlen(EmailAddress)-3)) on User
| project  AuthorName, IPAddress, User, EmailAddress, DomainName = tostring(extract("@(.*)$", 1, EmailAddress))
| where allowedDomain !contains DomainName