Cisco SEG - Multiple large emails sent to external recipient

Requête originale, sans modification.

let e_theshold = 3;
let s_threshold = 10000000;
CiscoSEGEvent
| where AdditionalFields[15]['ESAMsgSize'] > s_threshold
| where NetworkDirection =~ 'Outgoing'
| extend rec_domain = extract(@'@(.*)', 1, DstUserName)
| extend s_domain = extract(@'@(.*)', 1, SrcUserName)
| where s_domain != rec_domain
| summarize count() by SrcUserName
| where count_ >= e_theshold
| extend AccountCustomEntity = SrcUserName