✄𐘗
text code block:
✄𐘗from logs-o365.audit-*
| where
    event.dataset == "o365.audit" and
    event.provider == "OneDrive" and
    event.action == "FileDownloaded" and
    o365.audit.AuthenticationType == "OAuth" and
    event.outcome == "success"
    and (user.id is not null and o365.audit.ApplicationId is not null)
| eval session.id = coalesce(o365.audit.AppAccessContext.AADSessionId, session.id, null)
| where session.id is not null
| eval Esql.time_window_date_trunc = date_trunc(1 minutes, @timestamp)
| stats
    Esql.file_directory_values = values(file.directory),
    Esql.file_extension_values = values(file.extension),
    Esql.application_name_values = values(application.name),
    Esql.file_name_count_distinct = count_distinct(file.name),
    Esql.o365_audit_Site_values = values(o365.audit.Site),
    Esql.o365_audit_SiteUrl_values = values(o365.audit.SiteUrl),
    Esql.user_domain_values = values(user.domain),
    Esql.token_id_values = values(token.id),
    Esql.event_count = count(*)
by
    Esql.time_window_date_trunc,
    user.id,
    session.id,
    source.ip,
    o365.audit.ApplicationId
| where Esql.file_name_count_distinct >= 25
| keep
    Esql.*,
    user.id,
    source.ip,
    o365.audit.ApplicationId,
    session.id