Box - Abmormal user activity

Original query, unchanged.

let lbperiod_start = 14d;
let lbperiod_end = 24h;
let user_actions_1 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SourceName
| project TotalEvents, User = SourceName;
let user_actions_2 = BoxEvents
| where EventEndTime between (ago(lbperiod_start) .. ago(lbperiod_end))
| summarize TotalEvents = count() by SrcUserName
| project TotalEvents, User = SrcUserName;
let TotalActions = (union user_actions_1, user_actions_2)
| summarize TotalEvents = count() by User
| extend EventsPerDay = TotalEvents / 29
| extend k = 1;
let actions1_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let actions2_last_h = BoxEvents
| summarize TotalEventsH = count() by SourceName
| project TotalEventsH, User = SourceName;
let TotalActionsLastHour = (union actions1_last_h, actions2_last_h)
| summarize TotalEventsH = sum(TotalEventsH) by User
| extend k = 1;
TotalActions
| join (TotalActionsLastHour) on k
| where EventsPerDay > TotalEventsH
| project User
| extend AccountCustomEntity = User