Cisco ASA - Possible Data Exfiltration Detection

Original query, unchanged.

let Lookback = 1h;
let MinUploadBytes = 1073741824;
let MinUploadRatio = 95.0;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceProduct has_any ("ASA")
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| where ipv4_is_private(SourceIP)
| where not(ipv4_is_private(DestinationIP))
| where DeviceAction in~ ("allow", "allowed", "accept", "accepted", "permitted")
| extend SentBytesLong = tolong(SentBytes)
| extend ReceivedBytesLong = tolong(ReceivedBytes)
| where isnotnull(SentBytesLong)
| summarize
    TotalBytesSent = sum(SentBytesLong),
    TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),
    Connections = count(),
    DestinationPorts = make_set(DestinationPort, 20),
    Applications = make_set(ApplicationProtocol, 20),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP
| where TotalBytesSent >= MinUploadBytes
| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)
| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)
| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)
| where UploadRatio >= MinUploadRatio
| project
    TimeGenerated = LastSeen,
    SourceIP,
    DestinationIP,
    TotalGBSent,
    TotalGBReceived,
    UploadRatio,
    Connections,
    DestinationPorts,
    Applications,
    FirstSeen,
    LastSeen
| order by TotalGBSent desc