PROD (TM011.1) - LAPS - Tier Level Computer Object LAPS Password Expiration Time Set Manually

Requête originale, sans modification.

SecurityEvent
| where EventID == 5136
    and (EventData matches regex @"(?i)OU=Domain Controllers"
        or EventData matches regex @"(?i)OU=Tier 0 PAW"
        or EventData matches regex @"(?i)OU=Tier 1 PAW"
        or EventData matches regex @"(?i)OU=Tier 2 PAW"
        or EventData matches regex @"(?i)OU=Tier 0 Member Servers"
        or EventData matches regex @"(?i)OU=Tier 1 Member Servers")
    and AccountType == "User"
| extend AttributeLDAP = extract("<Data Name=\"AttributeLDAPDisplayName\">([^<]+)</Data>", 1, EventData)
| where AttributeLDAP has "msLAPS-PasswordExpirationTime"
| extend ObjectName_e = extract("<Data Name=\"ObjectDN\">([^<]+)</Data>", 1, EventData)
| extend ObjectName = extract("(?i)CN=([^,]+)", 1, ObjectName_e)
| extend ObjectTier = case(
    ObjectName_e has "Tier 0", "Tier 0",
    ObjectName_e has "Tier 1", "Tier 1",
    ObjectName_e has "Tier Model Administration", "Tier 0",
    ObjectName_e has "Tier Model Computer Quarantine", "Tier 0",
    ObjectName_e has "Domain Controllers", "Tier 0",
    "Unknown")
| extend ActivityType = extract("([a-zA-Z]+)\\.$", 1, Activity)
| extend Domain = extract("([^.]+\\.[^.]+)$", 1, Computer)
| extend OperationType = iff(EventData has 'OperationType">%%14674', "Added", tostring(OperationType))
| project TimeGenerated
   , ObjectName
   , ObjectTier
   , AttributeLDAP
   , ActivityType
   , Account
   , Domain
   , Computer
   , Channel
   , EventID
   , EventData