F&O - Mass update or deletion of user records

Original query, unchanged.

// Set threshold for number of updated or deleted records
let update_detection_threshold = 50;
let deleted_detection_threshold = 10;
FinanceOperationsActivity_CL
| where TableName == "UserInfo" and LogType in ("Update", "Delete")
| summarize
    TotalEvents = count(),
    StartTime = min(LogCreatedDateTime),
    EndTime = max(LogCreatedDateTime)
    by TableName, Username, LogType
| where (LogType == "Update" and TotalEvents > update_detection_threshold) or (LogType == "Delete" and TotalEvents > deleted_detection_threshold)
| extend FinOpsAppId = 32780
| project StartTime, EndTime, Username, LogType, TableName, TotalEvents, FinOpsAppId