Bitglass - User login from new geo location

Requête originale, sans modification.

Bitglass
| where EventType =~ 'access'
| where EventMessage =~ 'Login'
| summarize g_loc = makeset(SrcGeoLocation) by User
| join (Bitglass
        | where EventType =~ 'access'
        | where EventMessage =~ 'Login') on User
| where g_loc !contains SrcGeoLocation
| extend AccountCustomEntity = User, FileCustomEntity = SrcFileName