# IDR Query - Limit Results

**URL:** <https://discuss.rapid7.com/t/idr-query-limit-results/49097>\
**Category:** InsightIDR\
**Created:** [March 13, 2025, 11:23am UTC](https://discuss.rapid7.com/t/idr-query-limit-results/49097 "2025-03-13T11:23:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rpivm](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/r/439d5e/32.png) [@rpivm](https://discuss.rapid7.com/u/rpivm)\
**Post date:** [March 13, 2025, 11:23am UTC](https://discuss.rapid7.com/t/idr-query-limit-results/49097/1 "2025-03-13T11:23:04Z")

</div>

Hey,  
I have a query that checks for SharePoint downloads - sanitised query below:

```auto
where("source_json.Workload" = "SharePoint" AND "action" = "FileDownloaded"),loose) groupby( "source_json.ObjectId") 

```

This will trigger an alert if there are more than X amount of downloads from SharePoint over a 1 hour period.

Annoyingly, with SharePoint, it will generate multiple download logs per item thats accessed.  
The query currently totals up all users downloads over X period, rather than an individual user downloads.  
What i want to do is something like:  
For each user, if they have downloaded more than X files, raise an alert.

I am not sure how to focus the query like this.

Any ideas?

---

<div class="post-metadata">

**Author:** ![david\_smith1](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@david\_smith1](https://discuss.rapid7.com/u/david_smith1)\
**Post date:** [March 13, 2025, 6:39pm UTC](https://discuss.rapid7.com/t/idr-query-limit-results/49097/2 "2025-03-13T18:39:18Z")

</div>

You could need to add calculate(unique:filename)when grouping by user in order to establish per user filename counts.

When building your custom detection rule, you would then use the unique box in the detection rule near the bottom to include the filename key name (using filename as a placeholder as I’m not fully sure what the key name is)

David