✄𐘗
text code block:
✄𐘗FROM logs-anthropic.audit-* 
| where user.email IS NOT NULL and source.ip IS NOT NULL and  `user.email` != "unknown@invalid.internal"
| IP_LOCATION geo = source.ip with { "properties": ["country_name", "city_name", "location"] }
| stats Esql.country_count = COUNT_DISTINCT(geo.country_name), 
        Esql.source_ip_count = COUNT_DISTINCT(source.ip), 
        Esql.user_agent_count = COUNT_DISTINCT(`user_agent`.original),
        Esql.event_count = count(*),
        Esql.event_action_values = values(event.action), 
        Esql.source_ip_values = values(source.ip), 
        Esql.source_geo_country_name_values = values(geo.country_name), 
        Esql.source_geo_city_name_values = values(geo.city_name), 
        Esql.user_agent_original_values = values(user_agent.original), 
        Esql.timestamp_first_seen = min(@timestamp), 
        Esql.timestamp_last_seen = max(@timestamp) by user.email 
| where Esql.country_count >= 3 AND Esql.user_agent_count >= 2 AND 
  (MV_CONTAINS(Esql.event_action_values, "claude_chat_created") or MV_CONTAINS(Esql.event_action_values, "claude_chat_deleted") or MV_CONTAINS(Esql.event_action_values, "claude_user_settings_updated") or MV_CONTAINS(Esql.event_action_values, "claude_file_deleted") or MV_CONTAINS(Esql.event_action_values, "claude_chat_updated")) 
| Keep user.email, Esql.*