Detect Additional Cloud Credentials in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  QIDNAME(qid)                                  AS OperationName,
  username                                       AS InitiatingUPN,
  sourceip                                       AS InitiatingIPAddress,
  "TargetObjectName"                             AS TargetResource,
  "TargetObjectType"                             AS TargetType,
  "Result"                                       AS Result,
  LOGSOURCENAME(logsourceid)                     AS LogSource,
  CATEGORYNAME(highlevelcategory)                AS HighLevelCategory,
  magnitude,
  CASE
    WHEN LOWER(QIDNAME(qid)) LIKE '%certificate%' OR LOWER(QIDNAME(qid)) LIKE '%secret%' THEN 'Certificate_or_Secret'
    WHEN LOWER(QIDNAME(qid)) LIKE '%password%'    THEN 'AppPassword'
    WHEN LOWER(QIDNAME(qid)) LIKE '%credentials%' THEN 'ServicePrincipalCredential'
    ELSE 'Other'
  END AS CredentialType,
  CASE
    WHEN QIDNAME(qid) = 'Create application password for user' THEN 'MFA_Bypass_Risk'
    WHEN QIDNAME(qid) = 'Add service principal credentials'    THEN 'SP_Credential_Add'
    WHEN QIDNAME(qid) = 'Add owner to application'            THEN 'Ownership_Change'
    ELSE 'Low'
  END AS IsHighRisk
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (
    430,   -- Microsoft Azure Active Directory (verify ID in your deployment)
    520,   -- Microsoft Office 365 (verify ID in your deployment)
    540    -- Microsoft Azure Monitor (verify ID in your deployment)
  )
  AND (
    LOWER(QIDNAME(qid)) LIKE '%service principal credentials%'
    OR LOWER(QIDNAME(qid)) LIKE '%certificates and secrets%'
    OR LOWER(QIDNAME(qid)) LIKE '%application password%'
    OR LOWER(QIDNAME(qid)) LIKE '%app role assignment%'
    OR LOWER(QIDNAME(qid)) LIKE '%owner to application%'
    OR LOWER(QIDNAME(qid)) LIKE '%update service principal%'
    OR LOWER(QIDNAME(qid)) LIKE '%add application%'
  )
  AND (
    "Result" = 'success'
    OR "Result" IS NULL
    OR "Result" = ''
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000