Impossible travel / new-country anomaly via Zscaler NSS CEF geo fields
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Microsoft Sentinel (KQL)
