this is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. this search may also help investigate compromise of accounts. by looking at for example source ip addresses, document titles and abnormal number of shares and shared target users. | |