User and group membership reconnaissance (SAMR)

Hello,

We have received "User and group membership reconnaissance (SAMR)" from defender.

I only see the enumeration events no commands, process etc. related.

I was wondering how to find root cause for these queries from the user machine.

There is nothing seems suspicious but still we try to find what user machines made these.

Thanks.