✄𐘗
text code block:
✄𐘗from logs-okta*
| where
    event.dataset == "okta.system" and
    (event.action like "user.authentication.*" or event.action == "user.session.start") and
    okta.security_context.is_proxy != true and
    okta.actor.id != "unknown" and
    event.outcome == "success"
| keep
    event.action,
    okta.security_context.is_proxy,
    okta.actor.id,
    okta.actor.alternate_id,
    event.outcome,
    client.geo.country_name
| stats
    Esql.client_geo_country_name_count_distinct = count_distinct(client.geo.country_name)
    by okta.actor.id, okta.actor.alternate_id
| where
    Esql.client_geo_country_name_count_distinct >= 2
| sort
    Esql.client_geo_country_name_count_distinct desc