Corelight - Multiple files sent over HTTP with abnormal requests

Requête originale, sans modification.

let threshold = 25;
let fl_size_threshold = 10000000;
union isfuzzy=true corelight_http, corelight_http_agg
| where method in~ ('POST', 'PUT')
| where isempty(referrer)
| where tolong(request_body_len) > fl_size_threshold
| summarize count() by uri, id_orig_h, bin(TimeGenerated, 15m)
| where count_ > threshold