Impossible Travel Indicator: Multi-Country Logons
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day). This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
Microsoft Sentinel (KQL)
