Query Details
Login Location Not In US
Query
//Retrieves all non-US based logins SigninLogs | extend city_ = tostring(LocationDetails.city) | extend state_ = tostring(LocationDetails.state) | extend countryOrRegion_ = tostring(LocationDetails.countryOrRegion) | where countryOrRegion_ != "US" | distinct TimeGenerated, Identity, city_, state_, countryOrRegion_, IPAddress
Explanation
This query retrieves all logins that are not from the United States. It includes information about the time of the login, the user's identity, the city, state, country or region, and the IP address.
Details
Rod Trent
Released: December 8, 2021
Tables
SigninLogs
Keywords
SigninLogs,LocationDetails,TimeGenerated,Identity,city_,state_,countryOrRegion_,IPAddress
Operators
extendtostringwheredistinct