How to configure an email alert when a user uploads or sends a lot of data

Hello, I would like to receive an email when a user sends or receives a lot of data during his connection time in SSL or IPSEC. Could you tell me how to do it? I think you have to go to (from fortinet V7): - Security Fabric - Automation -Add Trigger - Event: IPSEC tunnel statistics and SSL VPN statistics but I don't know what to put in: - Field Filter (s) Do you have an idea ? Thank you, Sebastien