Detect Data Transfer Size Limits in Sumo Logic CSE

// Part 1: Process creation — compression/transfer tools with chunk/volume flags
(_sourceCategory=*windows* OR _sourceCategory=*endpoint* OR _sourceCategory=*sysmon*)
| where EventID = "1" or EventCode = "1"
| parse field=CommandLine "*" as cmd_full nodrop
| where (
    (
      Image matches "*\\7z.exe" or Image matches "*\\7za.exe" or Image matches "*\\7zr.exe"
      or Image matches "*\\rar.exe" or Image matches "*\\WinRAR.exe" or Image matches "*\\rclone.exe"
      or Image matches "*/7z" or Image matches "*/rclone"
    )
    and (
      CommandLine matches "* -v*" or CommandLine matches "* /v*"
      or CommandLine matches "*--max-size*" or CommandLine matches "*--chunk-size*"
      or CommandLine matches "*chunker*" or CommandLine matches "*split -b*"
      or CommandLine matches "*split -n*" or CommandLine matches "*--bytes*"
      or CommandLine matches "*-v10m*" or CommandLine matches "*-v50m*"
      or CommandLine matches "*-v100m*" or CommandLine matches "*-v500m*"
      or CommandLine matches "*-v1g*"
    )
  )
| if (Image matches "*rclone*" and CommandLine matches "*chunker*", "RcloneChunker",
     if (Image matches "*rclone*" and CommandLine matches "*--max-size*", "RcloneMaxSize",
         if ((Image matches "*7z*") and (CommandLine matches "* -v*" or CommandLine matches "* /v*"), "SevenZipVolume",
             if ((Image matches "*rar*" or Image matches "*winrar*") and (CommandLine matches "* -v*" or CommandLine matches "* /v*"), "RarVolume",
                 if (CommandLine matches "*split -b*" or CommandLine matches "*split -n*" or CommandLine matches "*--bytes*", "UnixSplit",
                     "GenericChunkFlag"))))) as SignalType
| eval DetectionSource = "ProcessCreation"
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, SignalType, DetectionSource

// Part 2 — run as separate query, then correlate:
// (_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
// | where EventID = "11" or EventCode = "11"
// | where TargetFilename matches "*.001" or TargetFilename matches "*.002"
//     or TargetFilename matches "*.003" or TargetFilename matches "*.part1"
//     or TargetFilename matches "*.part2" or TargetFilename matches "*.r00"
//     or TargetFilename matches "*.r01" or TargetFilename matches "*.7z.001"
//     or TargetFilename matches "*.zip.001" or TargetFilename matches "*.rar.001"
// | timeslice 10m
// | stats count as ChunkFileCount, values(TargetFilename) as ChunkFiles,
//         first(Computer) as Host, first(User) as User, first(Image) as Process
//   by _timeslice, Host
// | where ChunkFileCount >= 3
// | eval SignalType = "SequentialChunkFilesCreated"
// | eval DetectionSource = "FileCreation"
// | fields _timeslice, Host, User, Process, ChunkFiles, ChunkFileCount, SignalType, DetectionSource