Azure List Storage [splunk-azure]

`get_cloud_data` `get_cloud_data_storage` operationName IN(ListBlobs, ListShares, ListFiles, ListContainers)
| eval storage_name='properties.accountName', storage_type='properties.serviceType'
| rex field=src_ip mode=sed max_match=0 "s/\:\d{1,5}//g"
| table _time, host, user, account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, storage_*, uri
| bin span=60s
| stats values(*) as * by _time, src_ip
| eventstats dc(src_ip) as dc_src_ip by storage_name
| eventstats dc(storage_name) as dc_storage_name by src_ip
| where dc_storage_name > 0 
OR dc_src_ip > 0