Just out of curiosity, have you tried playing with the https://github.com/theflakes/bro-large_uploads/blob/master/large_uploads.bro script?
Works well, and it’s pretty good at producing different kinds of notices for large uploads to the internet, also it can easily be tweaked for detecting the large downloads as well, if that’s included in your use-case.
Also, you can change the limits of total byte transfer to whatever you would like.
Thanks,
Fatema.