// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel CEF proxy: one event per HTTP request; SentBytes must mean client-to-destination bytes.
// Requires CommonSecurityLog, SourceIP, DestinationHostName and SentBytes. Last 24h, at most 100 buckets.
// Near-uniformity is a lead. Do not alert on the ReliaQuest case's reported 1,800-byte payload size alone.
let SourceHost = "REPLACE_WITH_SOURCE_HOST_IP";
let Destination = "REPLACE_WITH_DESTINATION_FQDN";
CommonSecurityLog
| where TimeGenerated between (ago(24h) .. now())
| where SourceIP == SourceHost and DestinationHostName =~ Destination
| where SentBytes >= 256
| summarize Requests=count(), P10=percentile(SentBytes,10), P90=percentile(SentBytes,90),
    TotalSentBytes=sum(SentBytes), UrlSample=make_set(RequestURL,5)
    by SourceIP, DestinationHostName, Window=bin(TimeGenerated,5m)
| where Requests >= 20 and P90 <= P10 * 1.10
| order by TotalSentBytes desc
| take 100