User and group membership reconnaissance (SAMR)

Question

Hello,

We have received "User and group membership reconnaissance (SAMR)" from defender.

I only see the enumeration events no commands, process etc. related.

I was wondering how to find root cause for these queries from the user machine.

There is nothing seems suspicious but still we try to find what user machines made these.

Thanks.