Same User - Successful logon for a given App and failure on another App within 1m and low distribution

'This identifies when a user account successfully logs onto a given App and within 1 minute fails to logon to a different App. This may indicate a malicious attempt at accessing disallowed Apps for discovery or potential lateral movement'