Netskope - Excessive Downloads Detection (Spike vs Baseline)

Original query, unchanged.

let lookbackPeriod = 7d;
let currentPeriod = 1h;
let threshold = 3;
let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        BaselineAvgBytes = avg(ScBytes),
        BaselineTotalBytes = sum(ScBytes),
        BaselineCount = count()
        by CsUsername
    | extend BaselineDailyAvg = BaselineTotalBytes / 7;
let current = NetskopeWebTransactions_CL
    | where TimeGenerated > ago(currentPeriod)
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        CurrentTotalBytes = sum(ScBytes),
        CurrentCount = count(),
        Apps = make_set(XCsApp),
        Files = make_set(XCsAppObjectName)
        by CsUsername;
current
| join kind=inner baseline on CsUsername
| where CurrentTotalBytes > (BaselineDailyAvg * threshold)
| extend 
    SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),
    CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),
    BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)
| project 
    TimeGenerated = now(),
    User = CsUsername,
    CurrentDownloadMB = CurrentTotalMB,
    BaselineDailyAvgMB = BaselineDailyMB,
    SpikeMultiplier,
    DownloadCount = CurrentCount,
    ApplicationsUsed = Apps,
    FilesDownloaded = Files