Detect Data from Cloud Storage in IBM QRadar

SELECT
  DATEFORMAT((starttime / 1800000) * 1800000, 'YYYY-MM-dd HH:mm:ss') AS time_bucket,
  username AS actor,
  sourceip AS source_ip,
  LOGSOURCETYPENAME(logsourceid) AS platform,
  COUNT(*) AS total_requests,
  SUM(CASE
    WHEN QIDNAME(qid) LIKE '%GetObject%'
      OR QIDNAME(qid) LIKE '%FileDownload%'
      OR QIDNAME(qid) LIKE '%FileSyncDownload%'
    THEN 1 ELSE 0 END) AS download_count,
  SUM(CASE
    WHEN QIDNAME(qid) LIKE '%ListBucket%'
      OR QIDNAME(qid) LIKE '%ListObjects%'
      OR QIDNAME(qid) LIKE '%GetBucketAcl%'
      OR QIDNAME(qid) LIKE '%GetBucketPolicy%'
    THEN 1 ELSE 0 END) AS enum_count,
  SUM(CASE
    WHEN UTF8(payload) ILIKE '%AnonUser%'
      OR UTF8(payload) ILIKE '%"type":"Anonymous%'
      OR UTF8(payload) ILIKE '%principalId":"anonymous%'
    THEN 1 ELSE 0 END) AS anon_count,
  MAX(CASE
    WHEN UTF8(payload) ILIKE '%rclone%'
      OR UTF8(payload) ILIKE '%pacu%'
      OR UTF8(payload) ILIKE '%aadInternals%'
      OR UTF8(payload) ILIKE '%boto3%'
      OR UTF8(payload) ILIKE '%python-requests%'
      OR UTF8(payload) ILIKE '%aws-cli/%'
    THEN 1 ELSE 0 END) AS known_tool_detected,
  MAX(CASE
    WHEN UTF8(payload) ILIKE '%listKeys%'
      OR UTF8(payload) ILIKE '%regenerateKey%'
      OR UTF8(payload) ILIKE '%LISTKEYS/ACTION%'
      OR UTF8(payload) ILIKE '%REGENERATEKEY/ACTION%'
    THEN 1 ELSE 0 END) AS storage_key_access,
  (
    CASE WHEN SUM(CASE WHEN UTF8(payload) ILIKE '%AnonUser%' OR UTF8(payload) ILIKE '%"type":"Anonymous%' THEN 1 ELSE 0 END) > 0 THEN 3 ELSE 0 END +
    CASE WHEN SUM(CASE WHEN QIDNAME(qid) LIKE '%GetObject%' OR QIDNAME(qid) LIKE '%FileDownload%' THEN 1 ELSE 0 END) > 500 THEN 3
         WHEN SUM(CASE WHEN QIDNAME(qid) LIKE '%GetObject%' OR QIDNAME(qid) LIKE '%FileDownload%' THEN 1 ELSE 0 END) > 100 THEN 2
         WHEN SUM(CASE WHEN QIDNAME(qid) LIKE '%GetObject%' OR QIDNAME(qid) LIKE '%FileDownload%' THEN 1 ELSE 0 END) > 50 THEN 1
         ELSE 0 END +
    CASE WHEN SUM(CASE WHEN QIDNAME(qid) LIKE '%ListBucket%' OR QIDNAME(qid) LIKE '%ListObjects%' THEN 1 ELSE 0 END) > 20 THEN 1 ELSE 0 END +
    CASE WHEN MAX(CASE WHEN UTF8(payload) ILIKE '%rclone%' OR UTF8(payload) ILIKE '%pacu%' OR UTF8(payload) ILIKE '%aadInternals%' THEN 1 ELSE 0 END) = 1 THEN 2 ELSE 0 END
  ) AS suspicion_score
FROM events
WHERE (
    LOGSOURCETYPENAME(logsourceid) LIKE '%CloudTrail%'
    OR LOGSOURCETYPENAME(logsourceid) LIKE '%Office 365%'
    OR LOGSOURCETYPENAME(logsourceid) LIKE '%Azure Activity%'
  )
  AND (
    (UTF8(payload) ILIKE '%s3.amazonaws.com%'
     AND (
       QIDNAME(qid) LIKE '%GetObject%' OR QIDNAME(qid) LIKE '%ListBucket%'
       OR QIDNAME(qid) LIKE '%ListObjects%' OR QIDNAME(qid) LIKE '%GetBucketAcl%'
       OR QIDNAME(qid) LIKE '%GetBucketPolicy%' OR QIDNAME(qid) LIKE '%GetBucketPublicAccess%'
     )
    )
    OR (
      LOGSOURCETYPENAME(logsourceid) LIKE '%Office 365%'
      AND (
        QIDNAME(qid) LIKE '%FileDownload%' OR QIDNAME(qid) LIKE '%FileAccess%'
        OR QIDNAME(qid) LIKE '%FileCop%' OR QIDNAME(qid) LIKE '%FileSyncDownload%'
      )
      AND (UTF8(payload) ILIKE '%OneDrive%' OR UTF8(payload) ILIKE '%SharePoint%')
    )
    OR (
      UTF8(payload) ILIKE '%Microsoft.Storage%'
      AND (
        UTF8(payload) ILIKE '%listKeys%' OR UTF8(payload) ILIKE '%regenerateKey%'
        OR UTF8(payload) ILIKE '%storageAccounts/write%'
      )
    )
  )
GROUP BY (starttime / 1800000) * 1800000, username, sourceip
HAVING download_count > 50
    OR anon_count > 0
    OR known_tool_detected = 1
    OR enum_count > 20
    OR storage_key_access = 1
ORDER BY suspicion_score DESC, time_bucket DESC
LAST 86400 SECONDS