SAP ETD - Execution of Sensitive Function Module

Original query, unchanged.

let AuditTimeAgo = 60m;
let minThreshold= 1;
let minScore= 50;
let SenseModules = _GetWatchlist('SAP - Sensitive Function Modules')
| project trimmedFunctionModule = trim(@"\s+", FunctionModule);
SAPETDAlerts_CL
| where TimeGenerated > ago(AuditTimeAgo)
| where Threshold >= minThreshold and Score >= minScore
| where PatternName == "Critical Function module call in Test framework calls"
| mv-expand NormalizedTriggeringEvents
| extend sapOriginalEvent = tostring(NormalizedTriggeringEvents.OriginalEvent)
| extend Id_ = NormalizedTriggeringEvents.Id
| extend extracted_user_ip = tostring(NormalizedTriggeringEvents.NetworkIPAddressInitiator)
| extend extracted_sap_user = tostring(NormalizedTriggeringEvents.UserAccountActing)
| extend extracted_sid = tostring(NormalizedTriggeringEvents.SystemIdActor)
| extend extracted_instance_name = tostring(NormalizedTriggeringEvents.NetworkHostnameActor)
| extend extracted_instance_host = tostring(NormalizedTriggeringEvents.ServiceInstanceName)
| extend extracted_function_module = trim(@"\s+", tostring(NormalizedTriggeringEvents.ServiceFunctionName))
| extend extracted_system_role = tostring(NormalizedTriggeringEvents.SystemRoleReporter)
| where extracted_function_module in (SenseModules)
| extend AlertName = strcat("SAP ETD - Sensitive Function Module ", extracted_function_module," was executed by user ", extracted_sap_user, 
" in a ", tolower(extracted_system_role), " system"), Dummy = " "
| mv-expand Users
| extend
  UserAccountName = tostring(Users.UserAccountName),
  UserEmail = tostring(Users.EmailAddresses[0])