// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting, CloudAppEvents table.
// Accounts that downloaded more than 200 distinct files from SharePoint or OneDrive in one hour.
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType == "FileDownloaded"
| summarize Files = dcount(ObjectName) by AccountDisplayName, IPAddress, bin(Timestamp, 1h)
| where Files > 200
| order by Files desc