CloudAppEvents
| where IsImpersonated == 1
| extend
MailboxOwnerUPN = tostring(parse_json(RawEventData).MailboxOwnerUPN),
ActionPerformedBy = tostring(parse_json(RawEventData).UserId)
| where MailboxOwnerUPN != ActionPerformedBy
| summarize Impersonators = make_set(ActionPerformedBy) by MailboxOwnerUPN
| extend TotalImpersonators = array_length(Impersonators)
| top 10 by TotalImpersonators
CloudAppEvents
| where IsImpersonated == 1
| extend
MailboxOwnerUPN = tostring(parse_json(RawEventData).MailboxOwnerUPN),
ActionPerformedBy = tostring(parse_json(RawEventData).UserId)
| where MailboxOwnerUPN != ActionPerformedBy
| summarize Impersonators = make_set(ActionPerformedBy) by MailboxOwnerUPN
| extend TotalImpersonators = array_length(Impersonators)
| top 10 by TotalImpersonators