@Thijs Lecomte Here is the query:
OfficeActivity
| where TimeGenerated > ago(15m)
| where OfficeWorkload == "SharePoint"
| where Operation in ("FileDeleted", "FileSyncDownloadedFull", "FolderDeleted", "FileDownloaded")
| summarize count() by bin(TimeGenerated, 15m), Operation, UserId, Site_Url, ClientIP
| where count_ > 100
| extend AccountCustomEntity = UserId
| extend IPCustomEntity = ClientIP
| extend URLCustomEntity = Site_Url
The info generated here is the same as what I can see in the Audit Logs in Security and Compliance center.
Basically we're alerting for excessive downloads or deletions that might indicate malicious activity.
