PaloAlto - Dropping or denying session with traffic

Original query, unchanged.

let threshold = 100;
PaloAltoCDLEvent
| where EventResourceId =~ 'TRAFFIC'
| where EventResult has_any ("deny", "drop", "reject") 
| where tolong(DstBytes) > 0
| where tolong(NetworkPackets) > 0
| summarize count() by SrcIpAddr, DstUsername, bin(TimeGenerated, 10m)
| where count_ > threshold
| extend AccountCustomEntity = DstUsername, IPCustomEntity = SrcIpAddr