User Login from Different Countries within 3 hours

Original query, unchanged.

let timeframe = ago(3h);
let threshold = 2;
OktaSSO
| where column_ifexists('published_t', now()) >= timeframe
| where eventType_s =~ "user.session.start"
| where outcome_result_s =~ "SUCCESS"
| where isnotempty(column_ifexists('client_geographicalContext_country_s', ''))
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), NumOfCountries = dcount(tostring(column_ifexists('client_geographicalContext_country_s', ''))) by actor_alternateId_s
| where NumOfCountries >= threshold
| extend AccountName = tostring(split(actor_alternateId_s, "@")[0]), AccountUPNSuffix = tostring(split(actor_alternateId_s, "@")[1])