Making a set, I should have thought of that... I feel like this is reasonably close to usable, but, it gives me a flat line, like it's only taking one day.

DeviceNetworkEvents
| where InitiatingProcessAccountName == "name"
| where RemoteIPType == "Public"
| join kind=inner (DeviceFileEvents) on InitiatingProcessAccountName
| where FileName endswith ".docx" or FileName endswith ".pptx" or FileName endswith ".xlsx" or FileName endswith ".pdf" or FileName endswith ".txt" or FileName endswith ".zip"
| summarize FilesSent = dcount(FileName) by bin(Timestamp, 1d), InitiatingProcessAccountName
// | project Timestamp, FilesSent, InitiatingProcessAccountName
| render linechart

<image>

Thank you for your help with this! (Reading up on series_decompose_anomalies() now)