Should be any admin (domain admin, schema admin, enterprise admin, group policy creator, etc).

It should be an escalation and not a "use SIEM" for this. SIEM runs every 30 minutes, if there's a delay, someone technically has domain admin access for over 30 minutes, that's a lot of potential damage, especially in today's time.