Dataverse - Mass record updates

Original query, unchanged.

// Set threshold for number of updated records
let detection_threshold = 10000;
let query_frequency = 1h;
DataverseActivity
| where TimeGenerated >= ago(query_frequency)
| where Message == "Update"
| summarize EventCount = count() by InstanceUrl, UserId, ClientIp, Message
| where EventCount > detection_threshold
| join kind=inner(
    DataverseActivity
    | where TimeGenerated >= ago(query_frequency))
    on InstanceUrl, UserId, ClientIp, Message
| mv-expand Fields
| summarize
    UpdatedFields = make_set(Fields.Name, 100),
    FirstEvent = min(TimeGenerated)
    by UserId, ClientIp, InstanceUrl, EventCount, EntityName
| extend Details = bag_pack("Entity", EntityName, "Count", EventCount, "FieldsUpdated", UpdatedFields)
| summarize
    TotalEvents = sum(EventCount),
    FirstEvent = min(FirstEvent),
    Details = make_list(Details, 100)
    by UserId, ClientIp, InstanceUrl
| extend
    CloudAppId = int(32780),
    AccountName = tostring(split(UserId, '@')[0]),
    UPNSuffix = tostring(split(UserId, '@')[1])
| project
    FirstEvent,
    UserId,
    ClientIp,
    TotalEvents,
    Details,
    InstanceUrl,
    CloudAppId,
    AccountName,
    UPNSuffix