Netskope - DLP Incident Spike

Original query, unchanged.

let dlpIncidentThreshold = 10;
NetskopeAlertEvents_CL
| where TimeGenerated > ago(1h)
| where AlertType =~ "DLP" or isnotempty(DlpProfile) or isnotempty(DlpIncidentId)
| summarize
    IncidentCount = count(),
    DistinctIncidents = dcount(DlpIncidentId),
    Profiles = make_set(DlpProfile, 20),
    Rules = make_set(DlpRule, 20),
    Applications = make_set(App, 20),
    Files = make_set(DlpFile, 20),
    Activities = make_set(Activity, 10),
    Actions = make_set(Action, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by User, Userip, Hostname
| where IncidentCount > dlpIncidentThreshold
| order by IncidentCount desc
| project
    LastSeen,
    User,
    Userip,
    Hostname,
    IncidentCount,
    DistinctIncidents,
    Profiles,
    Rules,
    Applications,
    Files,
    Activities,
    Actions,
    FirstSeen