OfficeActivity
| where TimeGenerated > ago(1d)
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| where OfficeWorkload in ("SharePoint", "OneDrive")
| summarize DownloadCount = count(), Files = make_set(OfficeObjectId, 20) by UserId, ClientIP, bin(TimeGenerated, 1h)
| where DownloadCount >= 50
| sort by DownloadCount desc