from logs-o365.audit-*
| where
    @timestamp > now() - 14d and
    event.dataset == "o365.audit" and
    event.provider == "OneDrive" and
    event.action == "FileDownloaded" and
    o365.audit.AuthenticationType == "OAuth" and
    event.outcome == "success"
| eval
    Esql.time_window_date_trunc = date_trunc(1 minutes, @timestamp)
| keep
    Esql.time_window_date_trunc,
    o365.audit.UserId,
    file.name,
    source.ip
| stats
    Esql.file_name_count_distinct = count_distinct(file.name),
    Esql.event_count = count(*)
  by
    Esql.time_window_date_trunc,
    o365.audit.UserId,
    source.ip
| where
    Esql.file_name_count_distinct >= 25