Token use from new IP and country within 24h after device-code sign-in
Detects instances where an OAuth token is used from a new IP address and a new country within 24 hours of a successful device-code sign-in for the same user, potentially indicating token theft or abuse.
Splunk (SPL)
