// Illustrative; not run against live data. Microsoft Sentinel, IIS logs (W3CIISLog).
// For teams that run a member API: a caller reading far more in an hour than its own peak over the previous two weeks.
// 22.5 million records in about four days is roughly 66 a second; volume like that should not pass unnoticed.
let MemberApi = @"(?i)REPLACE_WITH_MEMBER_API_PATH_REGEX";
let Lookback = 14d;
let Recent = 1d;
let Calls = W3CIISLog
| where TimeGenerated >= ago(Lookback)
| where csUriStem matches regex MemberApi
| where scStatus startswith "2"
| extend Caller = iff(csUserName == "-", cIP, csUserName)
| summarize Requests = count(), BytesOut = sum(scBytes) by Caller, Hour = bin(TimeGenerated, 1h);
let Baseline = Calls
| where Hour < ago(Recent)
| summarize PeakRequests = max(Requests), PeakBytes = max(BytesOut) by Caller;
Calls
| where Hour >= ago(Recent)
| join kind=leftouter Baseline on Caller
| extend PeakRequests = coalesce(PeakRequests, 0), PeakBytes = coalesce(PeakBytes, 0)
| where Requests > 3 * PeakRequests + 100 or BytesOut > 3 * PeakBytes + 10000000
| project Hour, Caller, Requests, PeakRequests, BytesOut, PeakBytes
| order by BytesOut desc