User joining Zoom meeting from suspicious timezone

Original query, unchanged.

let schedule_lookback = 14d;
let join_lookback = 1d;
// If you want to whitelist specific timezones include them in a list here
let tz_whitelist = dynamic([]);
let meetings = (
ZoomLogs
| where TimeGenerated >= ago(schedule_lookback)
| where Event =~ "meeting.created"
| extend MeetingId = tostring(parse_json(MeetingEvents).MeetingId)
| extend SchedTimezone = tostring(parse_json(MeetingEvents).Timezone));
ZoomLogs
| where TimeGenerated >= ago(join_lookback)
| where Event =~ "meeting.participant_joined"
| extend JoinedTimeZone = tostring(parse_json(MeetingEvents).Timezone)
| extend MeetingName = tostring(parse_json(MeetingEvents).MeetingName)
| extend MeetingId = tostring(parse_json(MeetingEvents).MeetingId)
| where JoinedTimeZone !in (tz_whitelist)
| join (meetings) on MeetingId
| where SchedTimezone != JoinedTimeZone
| project TimeGenerated, MeetingName, JoiningUser=payload_object_participant_user_name_s, JoinedTimeZone, SchedTimezone, MeetingScheduler=User1
| extend AccountName = tostring(split(JoiningUser, "@")[0]), AccountUPNSuffix = tostring(split(JoiningUser, "@")[1])