FROM logs-okta*
| WHERE
    event.dataset == "okta.system"
    AND (event.action RLIKE "user\\.authentication(.*)" OR event.action == "user.session.start")
    AND okta.security_context.is_proxy != true and okta.actor.id != "unknown"
    AND event.outcome == "success"
| STATS
    geo_auth_counts = COUNT_DISTINCT(client.geo.country_name)
    BY okta.actor.id, okta.actor.alternate_id
| WHERE
    geo_auth_counts >= 2