Zscaler - ZPA connections from new country

Requête originale, sans modification.

let listCountries =
ZPAEvent 
| where TimeGenerated > ago(14d)
| where DvcAction == 'open'
| summarize ListofCountries = make_set(SrcGeoCountry) by DstUserName
| project ListofCountries;
ZPAEvent
| where isnotempty(SrcGeoCountry)
| where SrcGeoCountry !in (listCountries)
| summarize EventCount = count() by DstUserName, SrcGeoCountry
| project-away EventCount
| extend AccountCustomEntity = DstUserName