How to create a Policy to alert when 15 Internal files shared externally

[ss1247]

Hi,

Can some one help on how to create a Policy to alert when 15 "Internal" Classified files shared externally in 4 hours by a single user.