SharePoint File Activity Aggregation for User
This rule aggregates SharePoint activity logs for a specific user within a defined timeframe. It groups activities by operation and file, intended to support investigation into potential mass file access or data staging behavior by a specific user in SharePoint.
Microsoft Sentinel (KQL)
