Run this query weekly and integrate it into your security incident and event management (SIEM) dashboards.