Netskope - Impossible Travel Detection (Two Countries in Less Than 1 Hour)

Original query, unchanged.

let timeWindow = 1h;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername) and isnotempty(XCCountry)
| summarize 
    Countries = make_set(XCCountry),
    Locations = make_set(XCLocation),
    IPs = make_set(CIp),
    MinTime = min(TimeGenerated),
    MaxTime = max(TimeGenerated),
    EventCount = count()
    by CsUsername, bin(TimeGenerated, timeWindow)
| where array_length(Countries) > 1
| extend TimeDiffMinutes = datetime_diff('minute', MaxTime, MinTime)
| where TimeDiffMinutes < 60
| project 
    TimeGenerated,
    User = CsUsername,
    DistinctCountries = Countries,
    Locations,
    SourceIPs = IPs,
    TimeDifferenceMinutes = TimeDiffMinutes,
    EventCount,
    AlertDetails = strcat('User ', CsUsername, ' accessed from ', array_length(Countries), ' countries within ', TimeDiffMinutes, ' minutes')