[Custom threshold] Save the ECS group by fields at the AAD root level

[Custom threshold] Save the ECS group by fields at the AAD root level #160352