DDoS Attack IP Addresses - Percent Threshold

Original query, unchanged.

let T1 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
let T2 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_total = count() by destPublicIpAddress_s;
T2
  | join kind=leftouter T1 on destPublicIpAddress_s
  | project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total
  | order by percent_of_traffic desc
  | where percent_of_traffic > 5