Login Location Not In US
Query
//Retrieves all non-US based logins
SigninLogs
| extend city_ = tostring(LocationDetails.city)
| extend state_ = tostring(LocationDetails.state)
| extend countryOrRegion_ = tostring(LocationDetails.countryOrRegion)
| where countryOrRegion_ != "US"
| distinct TimeGenerated, Identity, city_, state_, countryOrRegion_, IPAddressExplanation
This query retrieves all logins that are not from the United States. It includes information about the time of the login, the user's identity, the city, state, country or region, and the IP address.
Details
Rod Trent
Released: December 8, 2021
Tables
SigninLogs
Keywords
SigninLogsLocationDetailsTimeGeneratedIdentitycity_state_countryOrRegion_IPAddress
Operators
extendtostringwheredistinct