index="REPLACE_WITH_WINDOWS_INDEX" source="XmlWinEventLog:Security" EventCode=5145 host="REPLACE_WITH_FILE_SERVER" earliest=-30d
| eval mask=tonumber(replace(AccessMask, "0x", ""), 16)
| where mask % 2 == 1 AND NOT like(SubjectUserName, "%$")
| bin _time span=1h
| stats dc(RelativeTargetName) AS distinct_files values(ShareName) AS shares values(IpAddress) AS sources BY _time SubjectUserName
| where distinct_files > 500
| sort 0 - distinct_files