Valimail Enforce - Unusual Rate of Configuration Changes or User Additions

Original query, unchanged.

let threshold = 3;
let timeWindow = 1h;
ValimailEnforceEvents_CL
| where EventCategory in (
    "DMARCPolicy",
    "SPFConfiguration",
    "DKIMConfiguration",
    "DomainManagement",
    "UserManagement"
  )
| summarize
    ChangeCount       = count(),
    HighValueCount    = countif(IsHighValueEvent == true),
    Domains           = make_set(Subject),
    DomainCount       = dcount(Subject),
    Actions           = make_set(EventType),
    Categories        = make_set(EventCategory),
    FirstSeen         = min(PerformedAt),
    LastSeen          = max(PerformedAt)
  by User, bin(PerformedAt, timeWindow)
| where ChangeCount > threshold
| extend
    AccountName   = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1]),
    DomainName    = tostring(Domains[0]),
    ChangesPerMin = round(todouble(ChangeCount) / 60.0, 2)