SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| where ServiceName !endswith "quot;
| where ServiceName != "krbtgt"
| summarize RequestCount = count(), TargetServices = make_set(ServiceName, 20), IPs = make_set(IpAddress) by TargetUserName, bin(TimeGenerated, 1h)
| where RequestCount >= 5
| sort by RequestCount desc